CVE-2018-12368: mozilla firefox
Vulnerability summary
CVE-2018-12368 is a high (CVSS 9.3) vulnerability in mozilla firefox. EPSS estimates a 4.83% chance of exploitation in the next 30 days, higher than 91.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 4Timeline
- 18-10-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. *Note: this issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.83%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
0.00 pp
From 4.83% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (posts.specterops.io)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mozilla3 products
- firefox≥ unspecified, < 61 | < 61.0 | ≥ 53.0, < 60.1.0
- firefox_esr≥ unspecified, < 60.1 | ≥ unspecified, < 52.9 | < 52.9
- thunderbird≥ unspecified, < 60 | ≥ unspecified, < 52.9 | < 52.9
1 vendor · 3 products
References
10 links- bugzilla.mozilla.org/show_bug.cgi?id=1468217X Refsource CONFIRMIssue TrackingPermissions RequiredVendor Advisory
- posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39X Refsource MISCExploitThird Party Advisory