PT-2022-6119 · Mozilla+4 · Firefox+5

Axel Chong · Published 2022-11-15 · Updated 2024-12-12 · CVE-2022-45413

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 107 Firefox for Android (affected versions not specified)

Description The issue is related to the use of open redirection when handling the S.browser fallback url parameter. An attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent, potentially allowing for a CSRF attack using a specially crafted web page. This issue only affects Firefox for Android, with other operating systems not being affected.

Recommendations For Firefox versions prior to 107, update to version 107 or later to resolve the issue. As a temporary workaround, consider restricting the use of the S.browser fallback url parameter to minimize the risk of exploitation.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2022-3090

ALT-PU-2022-3270

ALT-PU-2023-5754

ALT-PU-2023-6436

BDU:2023-00059

CVE-2022-45413

OPENSUSE-SU-2024:12518-1

OPENSUSE-SU-2024:14572-1

USN-5726-1

Affected Products

Alt Linux

Astra Linux

Firefox

Firefox For Android

Linuxmint

Ubuntu

References · 1897

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1791201 · Exploit
• https://mozilla.org/en-US/security/advisories/mfsa2022-47/#CVE-2022-45413 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2022-47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45406 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45413 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45409 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45413 · Security Note
• https://ubuntu.com/security/CVE-2022-45419 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45415 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-40674 · Vendor Advisory