Vulnerability · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-34483
High 8.8
In plain English
A high-severity unrestricted file upload in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to contain an executable extension, and by extension potentially tricked the user into executing malicious code. While very similar, this is a separate issue from CVE-2022-34482. This vulnerability affects Firefox < 102.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.21 | firefox | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.22 | firefox | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.23 | firefox | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.21 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.22 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.23 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34483 |
| Alpine:v3.24 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34483 |
Affected products (as reported)
Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H