CVE-2022-38472

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-384738.8A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). ThisCVE-2022-384744.3A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not alloCVE-2022-384756.5An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the valueCVE-2022-384767.5A data race could occur in the <code>PK11_ChangePW</code> function, potentially leading to a use-after-free vulnerability. In Firefox, this CVE-2022-384778.8Mozilla developer Nika Layzell and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103 and Firefox ESR 102.1. Some oCVE-2022-384788.8Members the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 103, Firefox ESR 102.1, and Firefox ESR 91.12. Some of theseCVE-2022-38488.8The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leadiCVE-2022-384816.1An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several CVE-2022-384824.3A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.CVE-2022-384848.8An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt PoCVE-2022-384856.5A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authentCVE-2022-384889.8logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter.