CVE-2022-3032

State: Published
Severity: Not scored
Published: Dec 22, 2022
Updated: Nov 19, 2024
Reserved: Aug 29, 2022

Description

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
ThunderbirdMozilla	before 102.2.1Affected before 91.13.1Affected

References

https://www.mozilla.org/security/advisories/mfsa2022-38/
https://www.mozilla.org/security/advisories/mfsa2022-39/
https://bugzilla.mozilla.org/show_bug.cgi?id=1783831

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.