8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
8 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
52.1%
Mozilla Thunderbird is prone to a security
bypass vulnerability.
# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
CPE = "cpe:/a:mozilla:thunderbird";
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.826722");
script_version("2024-02-15T05:05:40+0000");
script_cve_id("CVE-2022-45414");
script_tag(name:"cvss_base", value:"9.4");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:N");
script_tag(name:"last_modification", value:"2024-02-15 05:05:40 +0000 (Thu, 15 Feb 2024)");
script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N");
script_tag(name:"severity_origin", value:"NVD");
script_tag(name:"severity_date", value:"2023-01-05 14:29:00 +0000 (Thu, 05 Jan 2023)");
script_tag(name:"creation_date", value:"2022-12-01 12:51:50 +0530 (Thu, 01 Dec 2022)");
script_name("Mozilla Thunderbird Security Advisories (MFSA2022-50, MFSA2022-50) - Mac OS X");
script_tag(name:"summary", value:"Mozilla Thunderbird is prone to a security
bypass vulnerability.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present
on the target host.");
script_tag(name:"insight", value:"The flaw exists when a Thunderbird user quoted
from an HTML email and the email contained either a VIDEO tag with the POSTER
attribute or an OBJECT tag with a DATA attribute, a network request to the
referenced remote URL was performed, regardless of a configuration to block
remote content.");
script_tag(name:"impact", value:"Successful exploitation will allow
attackers to execute JavaScript code included in the message in the context
of the message compose document, read and modify the contents of the message
compose document, including the quoted original message, which could potentially
contain the decrypted plaintext of encrypted data in the crafted email.");
script_tag(name:"affected", value:"Mozilla Thunderbird version before
102.5.1 on Mac OS X.");
script_tag(name:"solution", value:"Upgrade to Mozilla Thunderbird version 102.5.1
or later, Please see the references for more information.");
script_tag(name:"solution_type", value:"VendorFix");
script_tag(name:"qod_type", value:"executable_version");
script_xref(name:"URL", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2022-50/");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2022 Greenbone AG");
script_family("General");
script_dependencies("gb_mozilla_prdts_detect_macosx.nasl");
script_mandatory_keys("Thunderbird/MacOSX/Version");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if( ! infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE ) ) exit( 0 );
vers = infos['version'];
path = infos['location'];
if(version_is_less(version:vers, test_version:"102.5.1"))
{
report = report_fixed_ver(installed_version:vers, fixed_version:"102.5.1", install_path:path);
security_message(data:report);
exit(0);
}
8.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
8 High
AI Score
Confidence
High
0.002 Low
EPSS
Percentile
52.1%