CVE-2022-22744 — Improper Encoding or Escaping of Output in Mozilla Firefox
Severity
8.8HIGHNVD
EPSS
0.4%
top 36.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Description
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.*This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
3GHSA▶
GHSA-4989-6q5w-wjgw: The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell↗2022-12-22
OSV▶
CVE-2022-22744: The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell↗2022-12-22
CVEList▶
CVE-2022-22744: The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell↗2022-12-22