PT-2022-3808 · Mozilla+1 · Firefox+1

Muneaki Nishimura · Published 2022-06-01 · Updated 2023-07-11 · CVE-2022-1887

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 101

Description The issue is related to a lack of protection against SQL query structure exploitation. This could allow a remote attacker to send specially crafted data to the application, potentially executing arbitrary SQL commands. The search term could be specified externally to trigger SQL injection.

Recommendations For versions prior to 101, update to version 101 or later to resolve the issue. As a temporary workaround, consider restricting access to external search terms to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

ALT-PU-2023-4336

ALT-PU-2023-4339

BDU:2022-04603

CVE-2022-1887

Affected Products

Alt Linux

Firefox

References · 6

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1767205 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1887 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2022-23 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1887 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2022-23 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04603 · Security Note