PT-2022-5240
CVE-2022-42927
·
تاريخ النشر
2022-10-18
·
تاريخ التحديث
2024-12-12
الوصف من
CVSS 3.1
8.1
عاليةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 106
Firefox ESR versions prior to 102.4
Thunderbird versions prior to 102.4
Description
A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via
performance.getEntries(). This issue is related to the inclusion of functions from an untrusted controlled area, which could allow a remote attacker to obtain URL entries from different sources by opening a specially crafted malicious site.Recommendations
For Firefox versions prior to 106, update to version 106 or later to resolve the issue.
For Firefox ESR versions prior to 102.4, update to version 102.4 or later to resolve the issue.
For Thunderbird versions prior to 102.4, update to version 102.4 or later to resolve the issue.
As a temporary workaround, consider restricting the use of the
performance.getEntries() function until a patch is available.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾