Vulnerability CVE-2022-45410: Information

Description

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Severity: MEDIUM (6.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2022-45410
Published: Dec. 22, 2022
Modified: Jan. 4, 2023

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus107.0-alt1126.0.1-alt1ALT-PU-2022-3090-1310119Fixed
firefoxp10107.0-alt0.p10.1118.0.2-alt0.p10.1ALT-PU-2022-3270-1310328Fixed
firefoxc10f1107.0-alt0.p10.1112.0.2-alt0.p10.1ALT-PU-2022-3270-1310328Fixed
firefoxp11107.0-alt1126.0.1-alt1ALT-PU-2022-3090-1310119Fixed
firefox-esrsisyphus102.5.0-alt1115.11.0-alt1ALT-PU-2022-3099-1310102Fixed
firefox-esrp10102.5.0-alt2115.11.0-alt1ALT-PU-2022-3340-1311456Fixed
firefox-esrp9102.6.0-alt0.c9.1102.11.0-alt0.c9.1ALT-PU-2023-4336-1319683Fixed
firefox-esrc10f1115.8.0-alt0.c10.1115.9.1-alt0.c10.1ALT-PU-2024-3614-2340631Fixed
firefox-esrc9f2102.6.0-alt0.c9.1102.12.0-alt0.c9.1ALT-PU-2023-1138-1309126Fixed
firefox-esrp11102.5.0-alt1115.11.0-alt1ALT-PU-2022-3099-1310102Fixed
thunderbirdsisyphus102.5.0-alt1115.9.0-alt1ALT-PU-2022-3097-1310101Fixed
thunderbirdp10102.5.0-alt1115.9.0-alt1ALT-PU-2022-3209-1310334Fixed
thunderbirdp9102.7.1-alt1102.11.0-alt0.c9.1ALT-PU-2023-4335-1319683Fixed
thunderbirdc10f1102.5.0-alt1115.9.0-alt0.c10.1ALT-PU-2022-3209-1310334Fixed
thunderbirdc9f2102.6.1-alt1102.11.0-alt0.c9.1ALT-PU-2023-1137-1309126Fixed
thunderbirdp11102.5.0-alt1115.9.0-alt1ALT-PU-2022-3097-1310101Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1658869
  • Issue Tracking
  • Permissions Required
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-49/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-48/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-47/
  • Vendor Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      107.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      102.5
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      102.5
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top