Log in Start free

Vulnerability · Published Dec 22, 2022 · Assigned by mozilla

CVE-2022-45411

Medium 6.1

In plain English

A medium-severity cross-site scripting in Firefox from Mozilla. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.6%top 50.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript (such as cookies protected by HTTPOnly). To mitigate this attack, browsers placed limits on <code>fetch()</code> and XMLHttpRequest; however some webservers have implemented non-standard headers such as <code>X-Http-Method-Override</code> that override the HTTP method, and made this attack possible again. Thunderbird has applied the same mitigations to the use of this and similar headers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8firefox102.5.0-1.el8_7.almaALSA-2022:8554
AlmaLinux:9firefox102.5.0-1.el9_1.almaALSA-2022:8580
AlmaLinux:8thunderbird102.5.0-2.el8_7.almaALSA-2022:8547
AlmaLinux:9thunderbird102.5.0-2.el9_1.almaALSA-2022:8561
Alpine:v3.20firefox-esr102.5.0-r0ALPINE-CVE-2022-45411
Alpine:v3.21firefox-esr102.5.0-r0ALPINE-CVE-2022-45411
Alpine:v3.22firefox-esr102.5.0-r0ALPINE-CVE-2022-45411
Alpine:v3.23firefox-esr102.5.0-r0ALPINE-CVE-2022-45411
Debian:12firefox-esr102.5.0esr-1DEBIAN-CVE-2022-45411
Debian:13firefox-esr102.5.0esr-1DEBIAN-CVE-2022-45411
Debian:14firefox-esr102.5.0esr-1DEBIAN-CVE-2022-45411
Debian:12thunderbird1:102.5.0-1DEBIAN-CVE-2022-45411
Debian:13thunderbird1:102.5.0-1DEBIAN-CVE-2022-45411
Debian:14thunderbird1:102.5.0-1DEBIAN-CVE-2022-45411
Rocky Linux:8firefox0:102.5.0-1.el8_7RLSA-2022:8554
Rocky Linux:8thunderbird0:102.5.0-2.el8_7RLSA-2022:8547
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2022-45411
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2022-45411
Ubuntu:22.04:LTSthunderbird1:102.7.1+build2-0ubuntu0.22.04.1UBUNTU-CVE-2022-45411
Ubuntu:22.04:LTSthunderbird1:102.7.1+build2-0ubuntu0.22.04.1USN-5824-1

Affected products (as reported)

VendorProductVersions
Mozilla Firefox ESR unspecified – before 102.5
Mozilla Thunderbird unspecified – before 102.5
Mozilla Firefox unspecified – before 107

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References