When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1783831 | Permissions Required |
| https://www.mozilla.org/security/advisories/mfsa2022-38/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-39/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Feb 2024, 02:47
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://bugzilla.mozilla.org/show_bug.cgi?id=1783831 - Permissions Required |
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-610 |
03 Jan 2023, 20:25
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-863 | |
| First Time |
Mozilla thunderbird
Mozilla |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CPE | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2022-38/ - Vendor Advisory | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2022-39/ - Vendor Advisory | |
| References | (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1783831 - Issue Tracking, Permissions Required, Vendor Advisory |
22 Dec 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-22 20:15
Updated : 2024-02-09 02:47
NVD link : CVE-2022-3032
Mitre link : CVE-2022-3032
CVE.ORG link : CVE-2022-3032
JSON object : View
Products Affected
mozilla
- thunderbird
CWE
CWE-610
Externally Controlled Reference to a Resource in Another Sphere