CVEvulnerability

CVE-2022-3032

6.5 MEDIUM Published 2022-12-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-12-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-610

Description

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Affected configurations

• mozilla thunderbird (< 91.13.1) • mozilla thunderbird (>= 102.0 < 102.2.1)

Related

Weakness · CWE (1)

  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

Referenced by CWE · observed example (1)

  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References