PT-2022-3335 · Mozilla+5 · Firefox+5

Gareth Heyes · Published 2022-06-28 · Updated 2024-12-12 · CVE-2022-34475

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 102

Description The issue is related to errors in HTML sanitization. It could allow a remote attacker to execute arbitrary code if the attacker's input is sanitized via the HTML Sanitizer API and references a same-origin JavaScript file containing the script to be executed. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 102, update to version 102 or later to resolve the issue. As a temporary workaround, consider restricting the use of the HTML Sanitizer API until a patch is available. Avoid using the HTML Sanitizer API to sanitize attacker input that references same-origin JavaScript files until the issue is resolved.

Exploit

Fix

XSS

RCE

Weakness Enumeration

CWE-79

CWE-20

Related Identifiers

ALT-PU-2022-2151

ALT-PU-2022-2458

ALT-PU-2022-2929

ALT-PU-2022-2930

ALT-PU-2023-1138

ALT-PU-2023-1139

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2022-04083

CVE-2022-34475

OESA-2023-1673

OESA-2023-1674

OPENSUSE-SU-2022_3396-1

OPENSUSE-SU-2024:12184-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2022:3272-1

SUSE-SU-2022:3273-1

SUSE-SU-2022:3396-1

USN-5504-1

Affected Products

Alt Linux

Astra Linux

Firefox

Linuxmint

Suse

Ubuntu

References · 2201

• 🔥 https://github.com/mistymntncop/CVE-2022-1802 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2022-28281 · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥❌ https://github.com/MagicPwnrin/CVE-2022-28282 · Exploit, Deleted
• 🔥❌ https://github.com/Pwnrin/CVE-2022-28282 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-23968 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45408 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2022-24/#CVE-2022-34475 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4046 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22748 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-34471 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22757 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-32205 · Security Note