CVE-2022-34483
published 2022-12-22CVE-2022-34483: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable…
PriorityP341high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.72%
49.4th percentile
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 102.0-1 (sid) | firefox 102.0-1 (sid) |
| mozilla | firefox | < 102.0 | 102.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 102.0+build2-0ubuntu0.18.04.1 | 102.0+build2-0ubuntu0.18.04.1 |
| mozilla | firefox | >= 0 < 102.0+build2-0ubuntu0.20.04.1 | 102.0+build2-0ubuntu0.20.04.1 |
| mozilla | firefox | >= unspecified < 102 | 102 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2022-07-05·CVSS 8.8
CVE-2022-34471 [HIGH] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the
browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions,
obtain sensitive information, bypass the HTML sanitizer, or execute
arbitrary code. (CVE-2022-2200, CVE-2022-34468, CVE-2022-34470,
CVE-2022-34473, CVE-2022-34474, CVE-2022-34475, CVE-2022-34476,
CVE-2022-34477, CVE-2022-34479, CVE-2022-34480, CVE-2022-34481,
CVE-2022-34484, CVE-2022-34485)
It was discovered that Firefox could be made to save an image with an
executable extension in
Debian
CVE-2022-34483: firefox - An attacker who could have convinced a user to drag and drop an image to a files...
vendor_debian·2022·CVSS 8.8
CVE-2022-34483 [HIGH] CVE-2022-34483: firefox - An attacker who could have convinced a user to drag and drop an image to a files...
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102.
Scope: local
sid: resolved (fixed in 102.0-1)
Debian
CVE-2022-34482: firefox - An attacker who could have convinced a user to drag and drop an image to a files...
vendor_debian·2022·CVSS 8.8
CVE-2022-34482 [HIGH] CVE-2022-34482: firefox - An attacker who could have convinced a user to drag and drop an image to a files...
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102.
Scope: local
sid: resolved (fixed in 102.0-1)
Mozilla
Mozilla Foundation Security Advisory 2022-24: CVE-2022-34483
vendor_mozilla·CVSS 8.8
CVE-2022-34483 [HIGH] Mozilla Foundation Security Advisory 2022-24: CVE-2022-34483
Mozilla Foundation Security Advisory 2022-24
CVE: CVE-2022-34483
Product: Firefox
Impact: moderate
Fixed in: Firefox 102
VulDB
Mozilla Firefox up to 101 Drag/Drop Remote Code Execution (Bug 1335845 / EUVD-2022-37438)
vuldb·2026-06-13·CVSS 8.8
CVE-2022-34483 [HIGH] Mozilla Firefox up to 101 Drag/Drop Remote Code Execution (Bug 1335845 / EUVD-2022-37438)
A vulnerability classified as critical was found in Mozilla Firefox up to 101. This issue affects some unknown processing of the component Drag/Drop Handler. Such manipulation leads to Remote Code Execution.
This vulnerability is uniquely identified as CVE-2022-34483. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is advised.
GHSA
GHSA-7vcp-35cw-vjp4: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
ghsa_unreviewed·2022-12-22·CVSS 8.8
CVE-2022-34482 [HIGH] CWE-434 GHSA-7vcp-35cw-vjp4: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102.
GHSA
GHSA-f7vm-6g4j-64q8: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
ghsa_unreviewed·2022-12-22·CVSS 8.8
CVE-2022-34483 [HIGH] CWE-434 GHSA-f7vm-6g4j-64q8: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102.
OSV
CVE-2022-34482: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
osv·2022-07-05·CVSS 8.8
CVE-2022-34482 [HIGH] CVE-2022-34482: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34483. This vulnerability affects Firefox < 102.
OSV
firefox vulnerabilities
osv·2022-07-05·CVSS 8.8
CVE-2022-2200 [HIGH] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the
browser UI, bypass CSP restrictions, bypass sandboxed iframe restrictions,
obtain sensitive information, bypass the HTML sanitizer, or execute
arbitrary code. (CVE-2022-2200, CVE-2022-34468, CVE-2022-34470,
CVE-2022-34473, CVE-2022-34474, CVE-2022-34475, CVE-2022-34476,
CVE-2022-34477, CVE-2022-34479, CVE-2022-34480, CVE-2022-34481,
CVE-2022-34484, CVE-2022-34485)
It was discovered that Firefox could be made to save an image with an
executable extension in the filename when dragging and dropping an image
in some circumstances. If a user were tricked into dragging an
OSV
CVE-2022-34483: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
osv·2022-07-05·CVSS 8.8
CVE-2022-34483 [HIGH] CVE-2022-34483: An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an exec
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-12-22
Published