CVE-2022-22756
Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Si se convenciera a un usuario de arrastrar y soltar una imagen en su escritorio u otra carpeta, el objeto resultante podría haberse convertido en un script ejecutable que habría ejecutado código arbitrario después de que el usuario hiciera clic en él. Esta vulnerabilidad afecta a Firefox < 97, Thunderbird < 91.6 y Firefox ESR < 91.6.
The Mozilla Foundation Security Advisory describes this flaw as:
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script, which would have run arbitrary code after the user clicked it.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-01-07 CVE Reserved
- 2022-02-14 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-08-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-1021: Improper Restriction of Rendered UI Layers or Frames
CAPEC
References (6)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1317873 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.mozilla.org/security/advisories/mfsa2022-04 | 2022-12-29 | |
| https://www.mozilla.org/security/advisories/mfsa2022-05 | 2022-12-29 | |
| https://www.mozilla.org/security/advisories/mfsa2022-06 | 2022-12-29 | |
| https://access.redhat.com/security/cve/CVE-2022-22756 | 2022-02-15 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2053237 | 2022-02-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 97.0 Search vendor "Mozilla" for product "Firefox" and version " < 97.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 91.6 Search vendor "Mozilla" for product "Firefox Esr" and version " < 91.6" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 91.6 Search vendor "Mozilla" for product "Thunderbird" and version " < 91.6" | - |
Affected
| ||||||