CVE-2022-31738 — Authentication Bypass by Spoofing in Mozilla Firefox
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 63.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Description
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages8 packages
🔴Vulnerability Details
4GHSA▶
GHSA-3v83-x3vq-3mmv: When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion o↗2022-12-22
CVEList▶
CVE-2022-31738: When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion o↗2022-12-22
OSV▶
CVE-2022-31738: When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion o↗2022-12-22
📋Vendor Advisories
7Debian▶
CVE-2022-31738: firefox - When exiting fullscreen mode, an iframe could have confused the browser about th...↗2022