This bug only affectsThunderbird for Windows. Other oper...">CVE-2022-22744 - vulnerability database | Vulners.comThis bug only affectsThunderbird for Windows. Other oper...">This bug only affectsThunderbird for Windows. Other oper...">This bug only affectsThunderbird for Windows. Other oper...">
Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-22744
HistoryDec 22, 2022 - 12:00 a.m.

CVE-2022-22744

2022-12-2200:00:00
ubuntu.com
ubuntu.com
12

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

41.4%

The constructed curl command from the “Copy as curl” feature in DevTools
was not properly escaped for PowerShell. This could have lead to command
injection if pasted into a Powershell prompt.<br>This bug only affects
Thunderbird for Windows. Other operating systems are unaffected.
. This
vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird <
91.5.

Notes

Author Note
tyhicks mozjs contains a copy of the SpiderMonkey JavaScript engine

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

41.4%