CVE-2022-38472

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-38472
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1769155 Issue Tracking Permissions Required Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1769155 Issue Tracking Permissions Required Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-33/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-33/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-34/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-34/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-35/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-35/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-36/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-37/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-37/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
History

15 Apr 2025, 17:15

Type Values Removed Values Added
References (MISC) https://www.mozilla.org/security/advisories/mfsa2022-33/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-33/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2022-36/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-36/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2022-34/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-34/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2022-37/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-37/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2022-35/ - Vendor Advisory () https://www.mozilla.org/security/advisories/mfsa2022-35/ - Vendor Advisory
References (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1769155 - Issue Tracking, Permissions Required, Vendor Advisory () https://bugzilla.mozilla.org/show_bug.cgi?id=1769155 - Issue Tracking, Permissions Required, Vendor Advisory

21 Oct 2024, 13:55

Type Values Removed Values Added
CPE cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Information

Published : 2022-12-22 20:15

Updated : 2025-04-15 17:15

NVD link : CVE-2022-38472

Mitre link : CVE-2022-38472

JSON object : View

Products Affected

mozilla

  • firefox
  • thunderbird
CWE
CWE-346

Origin Validation Error