CVE-2022-22759: Critical severity thunderbird vulnerability
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Other sources
If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-22759?
CVE-2022-22759 has been classified as a moderate severity vulnerability.
How do I fix CVE-2022-22759?
To fix CVE-2022-22759, update Firefox to version 97 or later, or update Firefox ESR to version 91.6 or later.
Which versions of Firefox are affected by CVE-2022-22759?
CVE-2022-22759 affects Firefox versions prior to 97 and Firefox ESR prior to 91.6.
Does CVE-2022-22759 affect Thunderbird?
Yes, CVE-2022-22759 affects Thunderbird versions prior to 91.6.
What is the impact of CVE-2022-22759?
The impact of CVE-2022-22759 includes potential script execution in sandboxed iframes without the required permissions.