If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1788096 | Issue Tracking Permissions Required Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2022-50/ | Vendor Advisory |
Configurations
History
08 Aug 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-Other |
05 Jan 2023, 14:29
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mozilla thunderbird
Mozilla |
|
| CPE | cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.mozilla.org/security/advisories/mfsa2022-50/ - Vendor Advisory | |
| References | (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1788096 - Issue Tracking, Permissions Required, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CWE | CWE-668 |
22 Dec 2022, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-22 20:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-45414
Mitre link : CVE-2022-45414
CVE.ORG link : CVE-2022-45414
JSON object : View
Products Affected
mozilla
- thunderbird
CWE