CVE-2022-45420

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

VendorProductVersions
MozillaFirefox ESR>= unspecified, < 102.5
MozillaThunderbird>= unspecified, < 102.5
MozillaFirefox>= unspecified, < 107

References

Timeline

Published
Dec 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-454218.8Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed CVE-2022-454227.8When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005.CVE-2022-454237.5Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credCVE-2022-454245.3Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key byCVE-2022-454257.5Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by expCVE-2022-454266.5Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by seCVE-2022-454277.2Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sendCVE-2022-454282.7Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by seCVE-2022-454297.5Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatCVE-2022-45435.5A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR bCVE-2022-454303.7Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access conCVE-2022-454317.5Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access contr
CVE-2022-45420: Medium severity, CVSS 6.5 | Vulnix