CVE-2022-38473 — Improper Preservation of Permissions in Mozilla Firefox

CWE-281 — Improper Preservation of Permissions CWE-1021 — UI Misrepresentation / Clickjacking14 documents8 sources

Severity

8.8HIGHNVD

EPSS

0.3%

top 42.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird

Timeline

PublishedDec 22

Description

A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

▶CVEListV5mozilla/firefoxunspecified — 104

▶NVDmozilla/firefox102.0 — 102.2+1

▶CVEListV5mozilla/firefox_esrunspecified — 91.13+1

▶NVDmozilla/firefox_esr< 91.13

▶CVEListV5mozilla/thunderbirdunspecified — 102.2+1

🔴Vulnerability Details

GHSA

GHSA-j9c4-m6g4-vjv3: A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)↗2022-12-22

▶

OSV

CVE-2022-38473: A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)↗2022-12-22

▶

CVEList

CVE-2022-38473: A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access)↗2022-12-22

▶

OSV

thunderbird vulnerabilities↗2022-10-07

▶

📋Vendor Advisories

Ubuntu

Thunderbird vulnerabilities↗2022-10-07

▶

Ubuntu

Firefox vulnerabilities↗2022-08-24

▶

Red Hat

Mozilla: Cross-origin XSLT Documents would have inherited the parent's permissions↗2022-08-23

▶

Debian

CVE-2022-38473: firefox - A cross-origin iframe referencing an XSLT document would inherit the parent doma...↗2022

▶

Mozilla

Mozilla Foundation Security Advisory 2022-36: CVE-2022-38473↗

▶