CVE-2023-37203 — Mozilla Firefox vulnerability
9 documents8 sources
Severity
7.8HIGHNVD
OSV6.5
EPSS
0.1%
top 82.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 5
Latest updateJul 11
Description
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could have been leveraged to execute arbitrary code. This vulnerability affects Firefox < 115.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
3GHSA▶
GHSA-r39w-v7w4-p94f: Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating↗2023-07-05
OSV▶
CVE-2023-37203: Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating↗2023-07-05
📋Vendor Advisories
4Microsoft▶
Insufficient validation in the Drag and Drop API in conjunction with social engineering, may have allowed an attacker to trick end-users into creating a shortcut to local system files. This could hav↗2023-07-11
Debian▶
CVE-2023-37203: firefox - Insufficient validation in the Drag and Drop API in conjunction with social engi...↗2023