CVE-2022-3032
First published: Wed Aug 31 2022(Updated: )
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <91.13.1 | 91.13.1 |
| <102.2.1 | 102.2.1 | |
| <91.13.1 | 91.13.1 | |
| Mozilla Thunderbird | <91.13.1 | |
| Mozilla Thunderbird | >=102.0<102.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2022-3032?
CVE-2022-3032 is a vulnerability that allows remote objects specified in an iframe element's nested document to be accessed without blocking access to the network.
Which software is affected by CVE-2022-3032?
Mozilla Thunderbird versions up to 91.13.1 and 102.2.1 are affected by CVE-2022-3032.
How severe is CVE-2022-3032?
CVE-2022-3032 has a severity rating of 6.5 (medium).
How can I fix CVE-2022-3032?
To fix CVE-2022-3032, update Mozilla Thunderbird to version 91.13.1 or higher.
Where can I find more information about CVE-2022-3032?
You can find more information about CVE-2022-3032 in the following references: [link1](https://bugzilla.mozilla.org/show_bug.cgi?id=1783831), [link2](https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/), [link3](https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/).
- collector/nvd-index
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- source/Mozilla
- agent/software-canonical-lookup
- agent/event
- agent/description
- agent/references
- agent/severity
- agent/weakness
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/mozilla
- canonical/mozilla thunderbird
- version/mozilla thunderbird/102.0