CVE-2022-34473: XSS
The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes. This vulnerability affects Firefox < 102.
Other sources
The HTML Sanitizer should have sanitized the href attribute of SVG <use> tags; however it incorrectly did not sanitize xlink:href attributes.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-34473?
CVE-2022-34473 has been classified as a moderate severity vulnerability affecting affected Versions of Mozilla Firefox below 102.
How do I fix CVE-2022-34473?
To fix CVE-2022-34473, upgrade Mozilla Firefox to version 102 or later.
Which versions of Firefox are affected by CVE-2022-34473?
CVE-2022-34473 affects all versions of Mozilla Firefox prior to version 102.
What is the impact of CVE-2022-34473?
The impact of CVE-2022-34473 is that it allows attackers to potentially exploit SVG <use> tags due to improper sanitization of xlink:href attributes.
Is there a workaround for CVE-2022-34473?
There are no known workarounds for CVE-2022-34473, and users are advised to update to the latest version of Firefox.