PT-2022-2466 · Mozilla+1 · Firefox For Android+1

Mark B · Published 2022-05-03 · Updated 2024-12-12 · CVE-2022-29910

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 100

Description The issue is related to errors in saving HSTS settings in Firefox for Android. When the browser is closed or sent to the background, it would not properly record and persist these settings. This could potentially allow a remote attacker to impact data integrity. The issue only affects Firefox for Android, with other operating systems being unaffected.

Recommendations For Firefox for Android versions prior to 100, update to version 100 or later to resolve the issue. As a temporary workaround, consider avoiding closing or sending the browser to the background to minimize the risk of HSTS setting loss.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-17

CWE-601

Related Identifiers

ALT-PU-2022-1812

ALT-PU-2022-2930

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2022-02872

CVE-2022-29910

OPENSUSE-SU-2024:12044-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox For Android

References · 1869

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1757138 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12044-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02872 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2022-16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29910 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2022-16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29910 · Security Note
• https://suse.com/security/cve/CVE-2023-25744 · Note
• https://suse.com/security/cve/CVE-2021-29962 · Note
• https://suse.com/security/cve/CVE-2023-29545 · Note
• https://suse.com/security/cve/CVE-2020-26955 · Note
• https://suse.com/security/cve/CVE-2015-2731 · Note
• https://suse.com/security/cve/CVE-2024-2612 · Note
• https://suse.com/security/cve/CVE-2023-5731 · Note