CVE-2022-38473: High severity Mozilla Firefox vulnerability
A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 91.13 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 102.2 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 104 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 91.13 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 102.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2022-38473?
CVE-2022-38473 is classified as a moderate severity vulnerability.
How do I fix CVE-2022-38473?
To fix CVE-2022-38473, update Mozilla Firefox or Thunderbird to versions 91.13, 102.2, or later releases.
What versions are affected by CVE-2022-38473?
CVE-2022-38473 affects Mozilla Firefox versions before 91.13, 102.2 and Thunderbird versions before 91.13, 102.2.
What type of vulnerability is CVE-2022-38473?
CVE-2022-38473 is a cross-origin resource vulnerability related to iframe handling.
Can CVE-2022-38473 allow unauthorized access to user data?
Yes, CVE-2022-38473 may allow unauthorized access to sensitive user data such as microphone or camera permissions.