CVE-2022-3032

2022-12-2200:00:00

mozilla

www.cve.org

html email

iframe

srcdoc

thunderbird

vulnerability

7.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.1%

JSON

When receiving an HTML email that contained an <code>iframe</code> element, which used a <code>srcdoc</code> attribute to define the inner HTML document, remote objects specified in the nested document, for example images or videos, were not blocked. Rather, the network was accessed, the objects were loaded and displayed. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

CNA Affected

[
  {
    "vendor": "Mozilla",
    "product": "Thunderbird",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "102.2.1",
        "status": "affected",
        "versionType": "custom"
      },
      {
        "version": "unspecified",
        "lessThan": "91.13.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]