CVEvulnerability
CVE-2022-31738
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-12-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-290
Description
When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Affected configurations
• mozilla firefox (< 101)
• mozilla firefox esr (< 91.10)
• mozilla thunderbird (< 91.10)
Related
Weakness · CWE (1)
- CWE-290 Authentication Bypass by Spoofing weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 Issue Tracking, Permissions Required, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-20/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-21/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-22/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 Issue Tracking, Permissions Required, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-20/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-21/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-22/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 Issue Tracking, Permissions Required, Vendor Advisory