Information disclosure in Mozilla Thunderbird
CVE-2022-45414
If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or an OBJECT tag with a DATA attribute, a network request to the referenced remote URL was performed, regardless of a configuration to block remote content. An image loaded from the POSTER attribute was shown in the composer window. These issues could have given an attacker additional capabilities when targetting releases that did not yet have a fix for CVE-2022-3033 which was reported around three months ago. This vulnerability affects Thunderbird < 102.5.1.
Vulnerability class: Information Disclosure
EPSS: 0.005 (41.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.
Affected products
- Mozilla Thunderbird — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@mozilla.org (Vendor Advisory)
- security@mozilla.org (Permissions Required, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-45414?
- CVE-2022-45414 is a high-severity vulnerability in Mozilla Thunderbird, classified under Information Disclosure. CVSS score: 8.1/10. Published 2022-12-22.
- How severe is CVE-2022-45414?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2022-45414 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.