CVE-2022-22761 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
firefox-0:91.6.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:0514	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:0538	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8
firefox-0:91.6.0-1.el8_5	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:0510	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_5	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:0535	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:91.6.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:0513	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:0539	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
firefox-0:91.6.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:0512	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:0537	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:91.6.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:0511	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:0536	2022-02-15T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1745566
https://nvd.nist.gov/vuln/detail/CVE-2022-22761
https://www.cve.org/CVERecord?id=CVE-2022-22761
https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22761
https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22761
https://www.mozilla.org/security/advisories/mfsa2022-04/
https://www.mozilla.org/security/advisories/mfsa2022-05/
https://www.mozilla.org/security/advisories/mfsa2022-06/

Type	Values Removed	Values Added
Weaknesses		CWE-693
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-22761", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-16T14:33:37.376Z", "dateReserved": "2022-01-07T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "97", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "91.6", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "91.6", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-04/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "frame-ancestors Content Security Policy directive was not enforced for framed extension pages"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:21:49.194Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-04/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-693", "lang": "en", "description": "CWE-693 Protection Mechanism Failure"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T14:33:31.795367Z", "id": "CVE-2022-22761", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:33:37.376Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-22761 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-16T14:33:37.376Z (string)

dateReserved : 2022-01-07T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 97 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.6 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.6 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-04/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : frame-ancestors Content Security Policy directive was not enforced for framed extension pages (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:21:49.194Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-04/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-693 (string)

lang : en (string)

description : CWE-693 Protection Mechanism Failure (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

tags : [ »

0 : exploit (string)

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.8 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-16T14:33:31.795367Z (string)

id : CVE-2022-22761 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T14:33:37.376Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-04/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:21:49.194Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-22761", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T14:33:31.795367Z"}}}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693 Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:32:56.159Z"}}], "cna": {"affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "97", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.6", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.6", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-04/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566"}], "descriptions": [{"lang": "en", "value": "Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "frame-ancestors Content Security Policy directive was not enforced for framed extension pages"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-22761", "state": "PUBLISHED", "dateUpdated": "2025-04-16T14:33:37.376Z", "dateReserved": "2022-01-07T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2022-12-22T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-04/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:21:49.194Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.8 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-22761 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-16T14:33:31.795367Z (string)

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

tags : [ »

0 : exploit (string)

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-693 (string)

description : CWE-693 Protection Mechanism Failure (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T14:32:56.159Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 97 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.6 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.6 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-04/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : frame-ancestors Content Security Policy directive was not enforced for framed extension pages (string)

}

]

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-22761 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-16T14:33:37.376Z (string)

dateReserved : 2022-01-07T00:00:00.000Z (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

assignerShortName : mozilla (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "56478BD7-9D9D-4513-9DDF-47AAC10550BF", "versionEndExcluding": "97.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "47FA8B4B-E1E9-47E3-89E2-16B66FC1F3F6", "versionEndExcluding": "91.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "7310C774-9E33-4B34-83CE-CA2FB0032F01", "versionEndExcluding": "91.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."}, {"lang": "es", "value": "Las p\u00e1ginas de extensi\u00f3n accesibles desde la web (p\u00e1ginas con un esquema moz-extension://) no aplicaban correctamente la directiva frame-ancestors cuando se usaba en la Pol\u00edtica de seguridad de contenido de la extensi\u00f3n web. Esta vulnerabilidad afecta a Firefox &lt; 97, Thunderbird &lt; 91.6 y Firefox ESR &lt; 91.6."}], "id": "CVE-2022-22761", "lastModified": "2025-04-16T15:15:49.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:20.013", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-693"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 56478BD7-9D9D-4513-9DDF-47AAC10550BF (string)

versionEndExcluding : 97.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 47FA8B4B-E1E9-47E3-89E2-16B66FC1F3F6 (string)

versionEndExcluding : 91.6 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7310C774-9E33-4B34-83CE-CA2FB0032F01 (string)

versionEndExcluding : 91.6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

}

1 : { »

lang : es (string)

value : Las páginas de extensión accesibles desde la web (páginas con un esquema moz-extension://) no aplicaban correctamente la directiva frame-ancestors cuando se usaba en la Política de seguridad de contenido de la extensión web. Esta vulnerabilidad afecta a Firefox < 97, Thunderbird < 91.6 y Firefox ESR < 91.6. (string)

}

]

id : CVE-2022-22761 (string)

lastModified : 2025-04-16T15:15:49.647 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:20.013 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-04/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-04/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

8 : { »

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1745566 (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-693 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2022:0514", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:91.6.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0538", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.6.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0510", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:91.6.0-1.el8_5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0535", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.6.0-1.el8_5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0513", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:91.6.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0539", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:91.6.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0512", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:91.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0537", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0511", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:91.6.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0536", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:91.6.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-02-15T00:00:00Z"}], "bugzilla": {"description": "Mozilla: frame-ancestors Content Security Policy directive was not enforced for framed extension pages", "id": "2053239", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2053239"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-829", "details": ["Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.", "The Mozilla Foundation Security Advisory describes this flaw as:\nWeb-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy."], "name": "CVE-2022-22761", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-02-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-22761\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-22761\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22761\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22761"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2022:0514 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:91.6.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-02-14T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:0538 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:91.6.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-02-15T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:0510 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:91.6.0-1.el8_5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-02-14T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:0535 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:91.6.0-1.el8_5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-02-15T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:0513 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:91.6.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-02-14T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:0539 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:91.6.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-02-15T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:0512 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:91.6.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-02-14T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:0537 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:91.6.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-02-15T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:0511 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:91.6.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-02-14T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:0536 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:91.6.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-02-15T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: frame-ancestors Content Security Policy directive was not enforced for framed extension pages (string)

id : 2053239 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2053239 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 8.8 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

status : verified (string)

}

cwe : CWE-829 (string)

details : [ »

0 : Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

1 : The Mozilla Foundation Security Advisory describes this flaw as: Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. (string)

]

name : CVE-2022-22761 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

2 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

3 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

]

public_date : 2022-02-08T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-22761 https://nvd.nist.gov/vuln/detail/CVE-2022-22761 https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22761 https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22761 (string)

]

statement : Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. (string)

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object