PT-2022-21220 · Unknown+1 · Ublock Origin+1

Young Min Kim · Published 2022-06-29 · Updated 2023-01-31 · CVE-2022-32308

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions uBlock Origin versions prior to 1.41.1

Description A Cross Site Scripting (XSS) issue allows remote attackers to run arbitrary code via a spoofed MessageSender.url to the browser renderer process. This enables attackers to execute malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations For versions prior to 1.41.1, update to version 1.41.1 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable websites or disabling the uBlock Origin extension until the update is applied.

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1156

CVE-2022-32308

DLA-3062-1

Affected Products

Alt Linux

Ublock Origin

References · 14

• https://github.com/uBlockOrigin/uBlock-issues/issues/1992 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-32308 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-32308 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-32308 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-32308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-32308 · Security Note
• https://ubuntu.com/security/CVE-2022-32308 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-32308 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3062-1 · Vendor Advisory
• https://github.com/gorhill/uBlock/commit/60072e7996e58cd7cca5186fde742d83cc6a612c · Note
• https://github.com/gorhill/uBlock/commit/e1e2ba3d5d00112f74464ddcc9f561f065dd3623 · Note
• https://t.me/cvenotify/33061 · Telegram Post
• https://t.me/cvenotify/33015 · Telegram Post
• https://t.me/cibsecurity/46211 · Telegram Post