CVE Vulnerabilities

CVE-2022-38473

Improper Preservation of Permissions

Published: Dec 22, 2022 | Modified: Nov 21, 2024
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
8.8 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

A cross-origin iframe referencing an XSLT document would inherit the parent domains permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

Weakness

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

Affected Software

Name Vendor Start Version End Version
Firefox Mozilla * 104.0 (excluding)
Firefox Mozilla 102.0 (including) 102.2 (excluding)
Firefox_esr Mozilla * 91.13 (excluding)
Thunderbird Mozilla * 91.13 (excluding)
Thunderbird Mozilla 102.0 (including) 102.2 (excluding)
Red Hat Enterprise Linux 7 RedHat thunderbird-0:91.13.0-1.el7_9 *
Red Hat Enterprise Linux 7 RedHat firefox-0:91.13.0-1.el7_9 *
Red Hat Enterprise Linux 8 RedHat thunderbird-0:91.13.0-1.el8_6 *
Red Hat Enterprise Linux 8 RedHat firefox-0:91.13.0-1.el8_6 *
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions RedHat thunderbird-0:91.13.0-1.el8_1 *
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions RedHat firefox-0:91.13.0-1.el8_1 *
Red Hat Enterprise Linux 8.2 Extended Update Support RedHat thunderbird-0:91.13.0-1.el8_2 *
Red Hat Enterprise Linux 8.2 Extended Update Support RedHat firefox-0:91.13.0-1.el8_2 *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat thunderbird-0:91.13.0-1.el8_4 *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat firefox-0:91.13.0-1.el8_4 *
Red Hat Enterprise Linux 9 RedHat thunderbird-0:91.13.0-1.el9_0 *
Red Hat Enterprise Linux 9 RedHat firefox-0:91.13.0-1.el9_0 *
Firefox Ubuntu bionic *
Firefox Ubuntu focal *
Firefox Ubuntu trusty *
Firefox Ubuntu upstream *
Firefox Ubuntu xenial *
Thunderbird Ubuntu bionic *
Thunderbird Ubuntu focal *
Thunderbird Ubuntu jammy *
Thunderbird Ubuntu kinetic *
Thunderbird Ubuntu trusty *
Thunderbird Ubuntu upstream *
Thunderbird Ubuntu xenial *

References