CVE-2022-45415: Malicious File Upload
When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that extension, leading to possible system compromise if the downloaded file was later ran.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 107 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 107
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-45415?
CVE-2022-45415 is a vulnerability in Mozilla Firefox that allows malicious files to be saved with incorrect extensions, potentially leading to system compromise.
How does CVE-2022-45415 affect Mozilla Firefox?
CVE-2022-45415 affects Mozilla Firefox versions up to and excluding version 107.
What is the severity of CVE-2022-45415?
CVE-2022-45415 has a severity level of medium.
How can CVE-2022-45415 be exploited?
CVE-2022-45415 can be exploited when downloading an HTML file with a maliciously formatted title.
Is there a fix for CVE-2022-45415?
Yes, Mozilla has released a remedy for CVE-2022-45415 in Firefox version 107.