CVE-2017-5414 Information disclosure in Firefox
An attacker can exploit a file picker flaw to disclose local system information like OS or account names via crafted web content.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5414?
CVE-2017-5414 is a medium-severity vulnerability in Mozilla Firefox, published on 11 Jun 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disclosure, such as the operating system or the local account name. This vulnerability affects Firefox < 52 and Thunderbird < 52.
Weakness: CWE-200
Which versions are affected by CVE-2017-5414?
It affects 2 products.
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2017-5414?
Upgrade to a fixed version.
Is CVE-2017-5414 being exploited?
There is no known exploitation of CVE-2017-5414 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-fch2-qg6h-c37w, UBUNTU-CVE-2017-5414.