CVE-2018-5182

Description

If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equivalent "file:" URL. This vulnerability affects Firefox < 60.

References

https://www.mozilla.org/security/advisories/mfsa2018-11/

https://usn.ubuntu.com/3645-1/

https://bugzilla.mozilla.org/show_bug.cgi?id=1435908

http://www.securitytracker.com/id/1040896

http://www.securityfocus.com/bid/104139

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3