CVE-2017-7821

HIGH

Description

A vulnerability where WebExtensions can download and attempt to open a file of some non-executable file types. This can be triggered without specific user interaction for the file download and open actions. This could be used to trigger known vulnerabilities in the programs that handle those document types. This vulnerability affects Firefox < 56.

References

http://www.securityfocus.com/bid/101057

http://www.securitytracker.com/id/1039465

https://bugzilla.mozilla.org/show_bug.cgi?id=1346515

https://www.mozilla.org/security/advisories/mfsa2017-21/

Details

Source: MITRE

Published: 2018-06-11

Updated: 2019-10-03

Type: CWE-732

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL