CVE-2022-3032: Medium severity thunderbird vulnerability
When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
Other sources
When receiving an HTML email that contained an iframe element, which used a srcdoc attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2022-3032?
CVE-2022-3032 is a vulnerability that allows remote objects specified in an iframe element's nested document to be accessed without blocking access to the network.
Which software is affected by CVE-2022-3032?
Mozilla Thunderbird versions up to 91.13.1 and 102.2.1 are affected by CVE-2022-3032.
How severe is CVE-2022-3032?
CVE-2022-3032 has a severity rating of 6.5 (medium).
How can I fix CVE-2022-3032?
To fix CVE-2022-3032, update Mozilla Thunderbird to version 91.13.1 or higher.
Where can I find more information about CVE-2022-3032?
You can find more information about CVE-2022-3032 in the following references: [link1](https://bugzilla.mozilla.org/show_bug.cgi?id=1783831), [link2](https://www.mozilla.org/en-US/security/advisories/mfsa2022-39/), [link3](https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/).