CVE-2022-38472: Medium severity Mozilla Firefox vulnerability
An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.13 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 104 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.13 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 102.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-38472?
CVE-2022-38472 has been classified as a moderate severity vulnerability due to the potential for user deception.
How do I fix CVE-2022-38472?
To fix CVE-2022-38472, users should update to the latest versions of Mozilla Firefox ESR or Thunderbird beyond the affected versions.
Which versions are affected by CVE-2022-38472?
CVE-2022-38472 affects Mozilla Firefox ESR versions prior to 91.13 and 102.2, as well as Mozilla Thunderbird versions prior to 91.13 and 102.2.
What type of vulnerability is CVE-2022-38472?
CVE-2022-38472 is an XSLT error handling vulnerability that could lead to content spoofing.
Is CVE-2022-38472 a local or remote vulnerability?
CVE-2022-38472 is primarily a remote vulnerability that can be exploited by an attacker through crafted web content.