CVE-2024-5692

MEDIUM 6.5

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file with a disallowed extension such as `.url` by including an invalid character in the extension. *Note:* This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.

Vendor	mozilla
Product	firefox
Ecosystems	Browser JavaScript
Industries	Technology
Published	Jun 11, 2024
Last Updated	Feb 27, 2026

Stay Ahead of the Next One

Get instant alerts for mozilla firefox

Be the first to know when new medium vulnerabilities affecting mozilla firefox are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Firefox

unspecified < 127

Mozilla / Firefox ESR

unspecified < 115.12

Mozilla / Thunderbird

unspecified < 115.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=1891234 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-25/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-26/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2024-28/

Credits

Raphael Shaniyazov