← Volver a CVEs

CVE-2022-3032

MEDIUM

6.5

Descripcion

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Detalles CVE

Puntuacion CVSS v3.16.5

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado12/22/2022

Ultima modificacion11/21/2024

Fuentenvd

Avistamientos honeypot0

Productos afectados

mozilla:thunderbird

Debilidades (CWE)

CWE-610

Referencias

https://bugzilla.mozilla.org/show_bug.cgi?id=1783831(security@mozilla.org)

https://www.mozilla.org/security/advisories/mfsa2022-38/(security@mozilla.org)

https://www.mozilla.org/security/advisories/mfsa2022-39/(security@mozilla.org)

https://bugzilla.mozilla.org/show_bug.cgi?id=1783831(af854a3a-2127-422b-91ae-364da2661108)

https://www.mozilla.org/security/advisories/mfsa2022-38/(af854a3a-2127-422b-91ae-364da2661108)

https://www.mozilla.org/security/advisories/mfsa2022-39/(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.