CVE-2022-1802

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Dec 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-18036.9Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2.CVE-2022-18045.5accountsservice no longer drops permissions when writting .pam_environment CVE-2022-18058.1When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue co CVE-2022-18066.1Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.CVE-2022-18077.2Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.CVE-2022-18088.8Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3.CVE-2022-18097.8Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0.CVE-2022-18104.3Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9.CVE-2022-18115.4Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9.CVE-2022-18129.8Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10.CVE-2022-18139.8OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0.CVE-2022-18144.8The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users