CVE-2022-1802

Name

CVE-2022-1802

Description

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.

NVD Severity

high

Other trackers

CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia

Mailing lists

oss-security, full-disclosure, bugtraq

Exploits

Exploit DB, Metasploit

Forges

GitHub (code, issues), Aports (code, issues)

Type	URI
MISC	https://bugzilla.mozilla.org/show_bug.cgi?id=1770137
MISC	https://www.mozilla.org/security/advisories/mfsa2022-19/

CPE URI	Source package	Min version	Max version
`cpe:2.3:a:mozilla:thunderbird::::::::`	thunderbird	>= None	< 91.9.1
`cpe:2.3:a:mozilla:firefox_esr::::::::`	firefox_esr	>= None	< 91.9.1
`cpe:2.3:a:mozilla:firefox::::::::`	firefox	>= None	< 100.0.2

References

Match rules

Vulnerable and fixed packages