CVE-2022-3034 — UI Misrepresentation / Clickjacking in Mozilla Thunderbird

CWE-1021 — UI Misrepresentation / ClickjackingCWE-449 — The UI Performs the Wrong Action9 documents7 sources
Severity
4.3MEDIUMNVD
OSV8.8
EPSS
0.2%
top 56.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla ThunderbirdDebian ThunderbirdMozilla Firefox
Timeline
PublishedDec 22

Description

When receiving an HTML email that specified to load an iframe element from a remote location, a request to the remote document was sent. However, Thunderbird didn't display the document. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages6 packages

▶debiandebian/thunderbird< thunderbird 1:102.2.1-1 (bookworm)
▶CVEListV5mozilla/thunderbirdunspecified — 102.2.1+1
▶NVDmozilla/thunderbird102.0 — 102.2.1+1
▶Debianmozilla/thunderbird< 1:102.2.1-1+2
▶Ubuntumozilla/thunderbird< 1:102.2.2+build1-0ubuntu0.18.04.1+2

🔴Vulnerability Details

3
GHSA
GHSA-wrfx-qxxc-92rj: When receiving an HTML email that specified to load an iframe element from a remote location, a request to the remote document was sent↗2022-12-22
▶
OSV
CVE-2022-3034: When receiving an HTML email that specified to load an iframe element from a remote location, a request to the remote document was sent↗2022-12-22
▶
OSV
thunderbird vulnerabilities↗2022-10-07
▶

📋Vendor Advisories

5
Ubuntu
Thunderbird vulnerabilities↗2022-10-07
▶
Red Hat
Mozilla: An iframe element in an HTML email could trigger a network request↗2022-08-31
▶
Debian
CVE-2022-3034: thunderbird - When receiving an HTML email that specified to load an <code>iframe</code> eleme...↗2022
▶
Mozilla
Mozilla Foundation Security Advisory 2022-38: CVE-2022-3034↗
▶
Mozilla
Mozilla Foundation Security Advisory 2022-39: CVE-2022-3034↗
▶