PT-2022-4951 · Mozilla+4 · Firefox+4
Jack Wrenn
·
Published
2022-02-08
·
Updated
2024-12-12
·
CVE-2022-22755
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 97
Description
The issue is related to insufficient control of resources during the existence of XML document transformations, allowing a remote attacker to cause a denial of service, bypass security restrictions, access confidential information, or execute arbitrary JavaScript code using a specially crafted XML document. A malicious web server could serve a user an XSL document that would continue to execute JavaScript within the bounds of the same-origin policy even after the tab was closed.
Recommendations
For versions prior to 97, update to version 97 or later to resolve the issue. As a temporary workaround, consider restricting the use of XSL Transforms in Firefox until a patch is applied. Avoid using Firefox to access untrusted websites or XML documents from unknown sources until the issue is resolved.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Firefox
Linuxmint
Ubuntu