PT-2020-6892 · Mozilla+4 · Firefox+4
Pete Freitag
·
Published
2020-06-10
·
Updated
2025-04-18
·
CVE-2022-46873
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 108
Description
The issue is related to the insufficient implementation of the
unsafe-hashes CSP directive in Firefox, allowing an attacker who can inject markup into a page protected by a Content Security Policy to potentially inject executable script. This would be constrained by the specified Content Security Policy of the document. The vulnerability may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.Recommendations
For versions prior to 108, update to a version that includes the fix for this issue to prevent potential exploitation. As a temporary workaround, consider restricting the use of the Content Security Policy to minimize the risk of exploitation. Avoid using the
unsafe-hashes directive in the Content Security Policy until the issue is resolved.Exploit
Fix
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Firefox
Linuxmint
Ubuntu