CVE-2022-40956: XSS

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1770094
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-42/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-40/
• https://www.mozilla.org/en-US/security/advisories/mfsa2022-41/
• https://www.mozilla.org/security/advisories/mfsa2022-40/
• https://www.mozilla.org/security/advisories/mfsa2022-41/
• https://www.mozilla.org/security/advisories/mfsa2022-42/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2022-42
• MFSA2022-41
• MFSA2022-40

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2022-3266
• CVE-2022-40959
• CVE-2022-40960
• CVE-2022-40958
• CVE-2022-40956
• CVE-2022-40957
• CVE-2022-3155
• CVE-2022-40962
• CVE-2022-46880
• CVE-2022-40961

Frequently Asked Questions

• What is the vulnerability ID for this issue?

  The vulnerability ID for this issue is CVE-2022-40956.

• What software is affected by this vulnerability?

  The affected software includes Mozilla Thunderbird up to version 102.3, Mozilla Firefox ESR up to version 102.3, and Mozilla Firefox up to version 105.

• What is the severity level of CVE-2022-40956?

  CVE-2022-40956 has a low severity level.

• What is the impact of this vulnerability?

  When injecting an HTML base element, some requests may ignore the CSP's base-uri settings and accept the injected element's base instead.

• Are there any remediation steps available for this vulnerability?

  The remedy for this vulnerability is to update to Mozilla Thunderbird version 102.3 or later, Mozilla Firefox ESR version 102.3 or later, or Mozilla Firefox version 105 or later.