Vulnerability Details : CVE-2022-22756
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Products affected by CVE-2022-22756
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-22756
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 66 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-22756
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
References for CVE-2022-22756
-
https://www.mozilla.org/security/advisories/mfsa2022-04/
Security Vulnerabilities fixed in Firefox 97 — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1317873
1317873 - (CVE-2022-22756) Tricking user into creating an executable by hijacking drag n drop of an imageExploit;Issue Tracking;Vendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2022-05/
Security Vulnerabilities fixed in Firefox ESR 91.6 — MozillaVendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2022-06/
Security Vulnerabilities fixed in Thunderbird 91.6 — MozillaVendor Advisory
Jump to