Vulnerability Description
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 104.0 |
| Mozilla | Thunderbird | < 91.13 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1769155Issue TrackingPermissions RequiredVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-35/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-36/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-37/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1769155Issue TrackingPermissions RequiredVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-35/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-36/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-37/Vendor Advisory
FAQ
What is CVE-2022-38472?
CVE-2022-38472 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into s...
How severe is CVE-2022-38472?
CVE-2022-38472 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-38472?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Thunderbird.