CVE-2022-32308 — Cross-site Scripting in Origin Project Ublock Origin

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.2%
top 62.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ublock Origin Project Ublock OriginDebian Ublock-origin
Timeline
PublishedJul 13
Latest updateJul 14

Description

Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶debiandebian/ublock-origin< ublock-origin 1.42.0+dfsg-1 (bookworm)

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-756h-ggr3-6vcj: Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1↗2022-07-14
▶
OSV
CVE-2022-32308: Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1↗2022-07-13
▶

📋Vendor Advisories

1
Debian
CVE-2022-32308: ublock-origin - Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41....↗2022
▶