CVE-2022-46874: mozilla firefox Code Injection

Vulnerability summary

CVE-2022-46874 is a high (CVSS 8.8) Code Injection vulnerability in mozilla firefox. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 60.2% of scored vulnerabilities.

Timeline

1. 22-12-2022
   PublishedVulnerability first disclosed.
2. 15-04-2025
   Last modifiedVulnerability information updated.

Description

A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.