CVE-2023-29542 — Unrestricted File Upload in Mozilla Firefox
Severity
9.8CRITICALNVD
EPSS
0.1%
top 66.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 19
Description
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.
*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
3CVEList▶
CVE-2023-29542: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as↗2023-06-19
GHSA▶
GHSA-pc79-pjx7-pq9h: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as↗2023-06-19
OSV▶
CVE-2023-29542: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as↗2023-06-19
📋Vendor Advisories
5Debian▶
CVE-2023-29542: firefox - A newline in a filename could have been used to bypass the file extension securi...↗2023