CVE-2022-45410

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-454116.1Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization heaCVE-2022-454128.8When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a sCVE-2022-454136.1Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookCVE-2022-454148.1If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the PCVE-2022-454157.8When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the fCVE-2022-454166.5Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as PriCVE-2022-454174.3Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk fCVE-2022-454186.1If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting inCVE-2022-454196.5If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certifiCVE-2022-45425.4The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting thCVE-2022-454206.5Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resultingCVE-2022-454218.8Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed