CVE-2022-34475: XSS
SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox < 102.
Other sources
SVG <use> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-34475?
CVE-2022-34475 is classified as a high severity vulnerability.
How do I fix CVE-2022-34475?
To fix CVE-2022-34475, update Mozilla Firefox to version 102.0 or later.
What impact does CVE-2022-34475 have on users?
CVE-2022-34475 could allow attackers to execute scripts through malicious SVG <code><use></code> tags.
Which versions of Firefox are affected by CVE-2022-34475?
CVE-2022-34475 affects Mozilla Firefox versions prior to 102.0.
Is the HTML Sanitizer API involved in CVE-2022-34475?
Yes, the HTML Sanitizer API plays a role in the vulnerability by potentially sanitizing attacker input.