PT-2022-3295

CVE-2022-31746

Published

2022-06-29

Updated

2023-08-08

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 102

Description The issue is related to the handling of HTTP requests, which could allow a remote attacker to bypass existing security restrictions and disclose protected information using the HTTP referer header. This is due to the potential leak of a secret UUID key through the Referrer header.

Recommendations For Firefox for iOS versions prior to 102, update to version 102 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Muneaki Nishimura

Vendors

Affected products

Weakness enumeration

CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor