CVE-2022-31738 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
firefox-0:91.10.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:4870	2022-06-01T00:00:00Z
thunderbird-0:91.10.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:4891	2022-06-03T00:00:00Z
Red Hat Enterprise Linux 8
firefox-0:91.10.0-1.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:4872	2022-06-01T00:00:00Z
thunderbird-0:91.10.0-1.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:4887	2022-06-03T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:91.10.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:4871	2022-06-01T00:00:00Z
thunderbird-0:91.10.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:4888	2022-06-03T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
firefox-0:91.10.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:4876	2022-06-01T00:00:00Z
thunderbird-0:91.10.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:4890	2022-06-03T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:91.10.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:4875	2022-06-01T00:00:00Z
thunderbird-0:91.10.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:4889	2022-06-02T00:00:00Z
Red Hat Enterprise Linux 9
firefox-0:91.10.0-1.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:4873	2022-06-01T00:00:00Z
thunderbird-0:91.10.0-1.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:4892	2022-06-03T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
https://nvd.nist.gov/vuln/detail/CVE-2022-31738
https://www.cve.org/CVERecord?id=CVE-2022-31738
https://www.mozilla.org/security/advisories/mfsa2022-20/
https://www.mozilla.org/security/advisories/mfsa2022-21/
https://www.mozilla.org/security/advisories/mfsa2022-22/

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-31738", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-16T13:54:09.514Z", "dateReserved": "2022-05-26T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10."}], "affected": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "91.10", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "101", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "91.10", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-20/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-22/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-21/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Browser window spoof using fullscreen mode"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:26:01.063Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-20/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-22/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-21/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-290", "lang": "en", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T13:54:02.484425Z", "id": "CVE-2022-31738", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T13:54:09.514Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-31738 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-16T13:54:09.514Z (string)

dateReserved : 2022-05-26T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.10 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 101 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.10 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-20/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-22/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-21/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Browser window spoof using fullscreen mode (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T07:26:01.063Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-20/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-22/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-21/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-290 (string)

lang : en (string)

description : CWE-290 Authentication Bypass by Spoofing (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

tags : [ »

0 : exploit (string)

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-16T13:54:02.484425Z (string)

id : CVE-2022-31738 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T13:54:09.514Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-20/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-22/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-21/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:26:01.063Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-31738", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-16T13:54:02.484425Z"}}}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T13:53:58.295Z"}}], "cna": {"affected": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.10", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "101", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.10", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-20/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-22/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-21/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388"}], "descriptions": [{"lang": "en", "value": "When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Browser window spoof using fullscreen mode"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-31738", "state": "PUBLISHED", "dateUpdated": "2025-04-16T13:54:09.514Z", "dateReserved": "2022-05-26T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2022-12-22T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-20/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-22/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-21/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T07:26:01.063Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-31738 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-16T13:54:02.484425Z (string)

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

tags : [ »

0 : exploit (string)

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-290 (string)

description : CWE-290 Authentication Bypass by Spoofing (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T13:53:58.295Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.10 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 101 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.10 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-20/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-22/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-21/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Browser window spoof using fullscreen mode (string)

}

]

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-31738 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-16T13:54:09.514Z (string)

dateReserved : 2022-05-26T00:00:00.000Z (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

assignerShortName : mozilla (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF017812-42B9-4EB1-8F83-8B9712529D2F", "versionEndExcluding": "101", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A30F8BF-AE74-4F4D-A80A-F924AA128DE5", "versionEndExcluding": "91.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A62DB30-D938-4ADD-BF43-9BBC56A6B8C0", "versionEndExcluding": "91.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10."}, {"lang": "es", "value": "Al salir del modo de pantalla completa, un iframe podr\u00eda haber confundido al navegador sobre el estado actual de la pantalla completa, lo que podr\u00eda generar confusi\u00f3n en el usuario o ataques de suplantaci\u00f3n de identidad. Esta vulnerabilidad afecta a Thunderbird &lt; 91.10, Firefox &lt; 101 y Firefox ESR &lt; 91.10."}], "id": "CVE-2022-31738", "lastModified": "2025-04-16T14:15:21.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:28.373", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-20/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-21/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-22/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-20/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-21/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-22/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1756388"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CF017812-42B9-4EB1-8F83-8B9712529D2F (string)

versionEndExcluding : 101 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4A30F8BF-AE74-4F4D-A80A-F924AA128DE5 (string)

versionEndExcluding : 91.10 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4A62DB30-D938-4ADD-BF43-9BBC56A6B8C0 (string)

versionEndExcluding : 91.10 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (string)

}

1 : { »

lang : es (string)

value : Al salir del modo de pantalla completa, un iframe podría haber confundido al navegador sobre el estado actual de la pantalla completa, lo que podría generar confusión en el usuario o ataques de suplantación de identidad. Esta vulnerabilidad afecta a Thunderbird < 91.10, Firefox < 101 y Firefox ESR < 91.10. (string)

}

]

id : CVE-2022-31738 (string)

lastModified : 2025-04-16T14:15:21.623 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:28.373 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

2 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-20/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-21/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-22/ (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

2 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-20/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-21/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-22/ (string)

}

8 : { »

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

2 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1756388 (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-290 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-290 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2022:4870", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:91.10.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-06-01T00:00:00Z"}, {"advisory": "RHSA-2022:4891", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.10.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-06-03T00:00:00Z"}, {"advisory": "RHSA-2022:4872", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:91.10.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-06-01T00:00:00Z"}, {"advisory": "RHSA-2022:4887", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.10.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-06-03T00:00:00Z"}, {"advisory": "RHSA-2022:4871", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:91.10.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-06-01T00:00:00Z"}, {"advisory": "RHSA-2022:4888", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:91.10.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-06-03T00:00:00Z"}, {"advisory": "RHSA-2022:4876", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:91.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-06-01T00:00:00Z"}, {"advisory": "RHSA-2022:4890", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.10.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-06-03T00:00:00Z"}, {"advisory": "RHSA-2022:4875", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:91.10.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-06-01T00:00:00Z"}, {"advisory": "RHSA-2022:4889", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:91.10.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-06-02T00:00:00Z"}, {"advisory": "RHSA-2022:4873", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:91.10.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-06-01T00:00:00Z"}, {"advisory": "RHSA-2022:4892", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:91.10.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-06-03T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Browser window spoof using fullscreen mode", "id": "2092021", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2092021"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-1021", "details": ["When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.", "A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when exiting fullscreen mode, an iframe could have confused the browser about the current state of the fullscreen, resulting in potential user confusion or spoofing attacks."], "name": "CVE-2022-31738", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2022-05-31T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-31738\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-31738"], "threat_severity": "Important"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2022:4870 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:91.10.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-06-01T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:4891 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:91.10.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-06-03T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:4872 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:91.10.0-1.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-06-01T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:4887 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:91.10.0-1.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-06-03T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:4871 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:91.10.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-06-01T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:4888 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:91.10.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-06-03T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:4876 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:91.10.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-06-01T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:4890 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:91.10.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-06-03T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:4875 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:91.10.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-06-01T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:4889 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:91.10.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-06-02T00:00:00Z (string)

}

10 : { »

advisory : RHSA-2022:4873 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : firefox-0:91.10.0-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-06-01T00:00:00Z (string)

}

11 : { »

advisory : RHSA-2022:4892 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : thunderbird-0:91.10.0-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-06-03T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: Browser window spoof using fullscreen mode (string)

id : 2092021 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2092021 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

status : verified (string)

}

cwe : CWE-1021 (string)

details : [ »

0 : When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10. (string)

1 : A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when exiting fullscreen mode, an iframe could have confused the browser about the current state of the fullscreen, resulting in potential user confusion or spoofing attacks. (string)

]

name : CVE-2022-31738 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

]

public_date : 2022-05-31T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-31738 https://nvd.nist.gov/vuln/detail/CVE-2022-31738 (string)

]

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object