CVE-2022-22761: High severity thunderbird vulnerability
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-22761?
CVE-2022-22761 has been classified as a high severity vulnerability due to improper enforcement of security policies.
How do I fix CVE-2022-22761?
To mitigate CVE-2022-22761, update to Mozilla Firefox version 97 or later, or Mozilla Firefox ESR version 91.6 or later.
Which software is affected by CVE-2022-22761?
CVE-2022-22761 affects Mozilla Firefox, Firefox ESR, and Thunderbird versions below 97 and 91.6 respectively.
What is the nature of the issue in CVE-2022-22761?
CVE-2022-22761 involves web-accessible extension pages not properly enforcing the frame-ancestors directive in Content Security Policy.
Can CVE-2022-22761 lead to cross-site scripting attacks?
Yes, CVE-2022-22761 can increase the risk of cross-site scripting attacks due to the lack of proper security policy enforcement.