CVE-2022-38472

Katalog CVE

CVSS 6.5 · Medium EPSS 0,37%

Kerentanan Origin Validation Error pada mozilla firefox, mozilla thunderbird. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

Rincian

Terbit di NVD

22 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1769155 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-33/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-34/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-35/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-36/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-37/ advisory vendor