CVE-2022-45415 File upload in Firefox
Firefox may save downloaded HTML files with malicious extensions based on page titles, potentially leading to system compromise if executed.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-45415?
CVE-2022-45415 is a high-severity vulnerability in Mozilla Firefox, published on 22 Dec 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran. This vulnerability affects Firefox < 107.
Weakness: CWE-434
Which versions are affected by CVE-2022-45415?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2022-45415?
Upgrade to a fixed version.
Is CVE-2022-45415 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45415 exists.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-jx2q-hvww-224r, UBUNTU-CVE-2022-45415.