CVEvulnerability
CVE-2022-29916
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-12-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-200
Description
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. This could have been used to probe the browser history. This vulnerability affects Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox < 100.
Affected configurations
• mozilla firefox (< 100.0)
• mozilla firefox esr (< 91.9)
• mozilla thunderbird (< 91.9)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1760674 Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-16/ Exploit, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-17/ Exploit, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-18/ Exploit, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1760674 Exploit, Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-16/ Exploit, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-17/ Exploit, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-18/ Exploit, Vendor Advisory