CVE-2022-38473: High severity thunderbird vulnerability
Published Aug 23, 2022
·Updated
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access).
Affected Software
11 affected componentsFixes available
Mozilla Thunderbird<91.13
91.13
Mozilla Thunderbird<102.2
102.2
Mozilla Firefox<104.0
Mozilla Firefox ESR<91.13
Mozilla Firefox ESR>=102.0<102.2
Mozilla Thunderbird<91.13
Mozilla Thunderbird>=102.0<102.2
Mozilla Firefox<104
104
Mozilla Firefox ESR<91.13
91.13
Mozilla Firefox ESR<102.2
102.2
Mozilla Firefox>=102.0<102.2
Event History
Aug 23, 2022
CVE Published
via Mozilla·12:00 AM
Dec 22, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the severity of CVE-2022-38473?
CVE-2022-38473 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2022-38473?
To fix CVE-2022-38473, update Mozilla Firefox or Thunderbird to versions 91.13, 102.2, or later releases.
3
What versions are affected by CVE-2022-38473?
CVE-2022-38473 affects Mozilla Firefox versions before 91.13, 102.2 and Thunderbird versions before 91.13, 102.2.
4
What type of vulnerability is CVE-2022-38473?
CVE-2022-38473 is a cross-origin resource vulnerability related to iframe handling.
5
Can CVE-2022-38473 allow unauthorized access to user data?
Yes, CVE-2022-38473 may allow unauthorized access to sensitive user data such as microphone or camera permissions.