PT-2022-3295 · Mozilla · Firefox

Muneaki Nishimura · Published 2022-06-29 · Updated 2023-08-08 · CVE-2022-31746

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 102

Description The issue is related to the handling of HTTP requests, which could allow a remote attacker to bypass existing security restrictions and disclose protected information using the HTTP referer header. This is due to the potential leak of a secret UUID key through the Referrer header.

Recommendations For Firefox for iOS versions prior to 102, update to version 102 or later to resolve the issue.

Exploit

Fix

Information Disclosure

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-644

CWE-200

CWE-444

Related Identifiers

BDU:2022-04033

CVE-2022-31746

Affected Products

Firefox

References · 6

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1654416 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31746 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2022-27 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04033 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31746 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2022-27 · Vendor Advisory