CVE-2022-42927 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
firefox-0:102.4.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:7069	2022-10-20T00:00:00Z
thunderbird-0:102.4.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:7184	2022-10-25T00:00:00Z
Red Hat Enterprise Linux 8
firefox-0:102.4.0-1.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:7070	2022-10-20T00:00:00Z
thunderbird-0:102.4.0-1.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:7190	2022-10-25T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:102.4.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:7066	2022-10-20T00:00:00Z
thunderbird-0:102.4.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:7183	2022-10-25T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
firefox-0:102.4.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:7068	2022-10-20T00:00:00Z
thunderbird-0:102.4.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:7182	2022-10-25T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:102.4.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:7072	2022-10-20T00:00:00Z
thunderbird-0:102.4.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:7181	2022-10-25T00:00:00Z
Red Hat Enterprise Linux 9
firefox-0:102.4.0-1.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:7071	2022-10-20T00:00:00Z
thunderbird-0:102.4.0-1.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:7178	2022-10-25T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1789128
https://nvd.nist.gov/vuln/detail/CVE-2022-42927
https://www.cve.org/CVERecord?id=CVE-2022-42927
https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/#CVE-2022-42927
https://www.mozilla.org/en-US/security/advisories/mfsa2022-46/#CVE-2022-42927
https://www.mozilla.org/security/advisories/mfsa2022-44/
https://www.mozilla.org/security/advisories/mfsa2022-45/
https://www.mozilla.org/security/advisories/mfsa2022-46/

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-42927", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-15T15:46:11.306Z", "dateReserved": "2022-10-14T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "106", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"lessThan": "102.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "102.4", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via <code>performance.getEntries()</code>. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4."}]}], "problemTypes": [{"descriptions": [{"description": "Same-origin policy violation could have leaked cross-origin URLs", "lang": "en", "type": "text"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-44/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-45/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-46/"}], "credits": [{"lang": "en", "value": "James Lee"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2023-09-13T10:36:17.164Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:19:05.529Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-44/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-45/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-46/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-15T15:45:37.003947Z", "id": "CVE-2022-42927", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T15:46:11.306Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-42927 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-15T15:46:11.306Z (string)

dateReserved : 2022-10-14T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

product : Firefox (string)

vendor : Mozilla (string)

versions : [ »

0 : { »

lessThan : 106 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

1 : { »

product : Firefox ESR (string)

vendor : Mozilla (string)

versions : [ »

0 : { »

lessThan : 102.4 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

2 : { »

product : Thunderbird (string)

vendor : Mozilla (string)

versions : [ »

0 : { »

lessThan : 102.4 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

base64 : false (boolean)

value : A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via <code>performance.getEntries()</code>. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Same-origin policy violation could have leaked cross-origin URLs (string)

lang : en (string)

type : text (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-44/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-45/ (string)

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-46/ (string)

}

]

credits : [ »

0 : { »

lang : en (string)

value : James Lee (string)

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2023-09-13T10:36:17.164Z (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:19:05.529Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-44/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-45/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-46/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-346 (string)

lang : en (string)

description : CWE-346 Origin Validation Error (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

tags : [ »

0 : exploit (string)

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.1 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-15T15:45:37.003947Z (string)

id : CVE-2022-42927 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-15T15:46:11.306Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-44/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-45/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-46/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T13:19:05.529Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-42927", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-15T15:45:37.003947Z"}}}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T15:46:05.639Z"}}], "cna": {"credits": [{"lang": "en", "value": "James Lee"}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "106", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102.4", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "102.4", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-44/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-45/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-46/"}], "descriptions": [{"lang": "en", "value": "A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.", "supportingMedia": [{"type": "text/html", "value": "A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via <code>performance.getEntries()</code>. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Same-origin policy violation could have leaked cross-origin URLs"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2023-09-13T10:36:17.164Z"}}}, "cveMetadata": {"cveId": "CVE-2022-42927", "state": "PUBLISHED", "dateUpdated": "2025-04-15T15:46:11.306Z", "dateReserved": "2022-10-14T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2022-12-22T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-44/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-45/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-46/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T13:19:05.529Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.1 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-42927 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-15T15:45:37.003947Z (string)

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

tags : [ »

0 : exploit (string)

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-346 (string)

description : CWE-346 Origin Validation Error (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-15T15:46:05.639Z (string)

}

]

cna : { »

credits : [ »

0 : { »

lang : en (string)

value : James Lee (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 106 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 102.4 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 102.4 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-44/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-45/ (string)

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-46/ (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via <code>performance.getEntries()</code>. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Same-origin policy violation could have leaked cross-origin URLs (string)

}

]

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2023-09-13T10:36:17.164Z (string)

}

cveMetadata : { »

cveId : CVE-2022-42927 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-15T15:46:11.306Z (string)

dateReserved : 2022-10-14T00:00:00.000Z (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

assignerShortName : mozilla (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "181587B4-3F8B-4B6F-8791-0323506EC07F", "versionEndExcluding": "106.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "580471D3-4C6C-4B73-A8DF-1823E1B2C683", "versionEndExcluding": "102.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "A311D0A5-0DA7-4C09-8C3D-3CBBF0273284", "versionEndExcluding": "102.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4."}, {"lang": "es", "value": "Una infracci\u00f3n de la pol\u00edtica del mismo origen podr\u00eda haber permitido el robo de entradas de URL de origen cruzado, filtrando el resultado de una redirecci\u00f3n, a trav\u00e9s de 'performance.getEntries()'. Esta vulnerabilidad afecta a Firefox &lt; 106, Firefox ESR &lt; 102.4 y Thunderbird &lt; 102.4."}], "id": "CVE-2022-42927", "lastModified": "2025-04-15T16:15:19.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:40.127", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-44/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-45/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-46/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-44/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-45/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-46/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1789128"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-346"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 181587B4-3F8B-4B6F-8791-0323506EC07F (string)

versionEndExcluding : 106.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 580471D3-4C6C-4B73-A8DF-1823E1B2C683 (string)

versionEndExcluding : 102.4 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A311D0A5-0DA7-4C09-8C3D-3CBBF0273284 (string)

versionEndExcluding : 102.4 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (string)

}

1 : { »

lang : es (string)

value : Una infracción de la política del mismo origen podría haber permitido el robo de entradas de URL de origen cruzado, filtrando el resultado de una redirección, a través de 'performance.getEntries()'. Esta vulnerabilidad afecta a Firefox < 106, Firefox ESR < 102.4 y Thunderbird < 102.4. (string)

}

]

id : CVE-2022-42927 (string)

lastModified : 2025-04-15T16:15:19.590 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 8.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.2 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 8.1 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.2 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:40.127 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-44/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-45/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-46/ (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-44/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-45/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-46/ (string)

}

8 : { »

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1789128 (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-346 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-346 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges James Lee as the original reporter.", "affected_release": [{"advisory": "RHSA-2022:7069", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:102.4.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-10-20T00:00:00Z"}, {"advisory": "RHSA-2022:7184", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:102.4.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-10-25T00:00:00Z"}, {"advisory": "RHSA-2022:7070", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:102.4.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-10-20T00:00:00Z"}, {"advisory": "RHSA-2022:7190", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:102.4.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-10-25T00:00:00Z"}, {"advisory": "RHSA-2022:7066", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:102.4.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-10-20T00:00:00Z"}, {"advisory": "RHSA-2022:7183", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:102.4.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-10-25T00:00:00Z"}, {"advisory": "RHSA-2022:7068", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:102.4.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-10-20T00:00:00Z"}, {"advisory": "RHSA-2022:7182", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:102.4.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-10-25T00:00:00Z"}, {"advisory": "RHSA-2022:7072", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:102.4.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-10-20T00:00:00Z"}, {"advisory": "RHSA-2022:7181", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:102.4.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-10-25T00:00:00Z"}, {"advisory": "RHSA-2022:7071", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:102.4.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-10-20T00:00:00Z"}, {"advisory": "RHSA-2022:7178", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:102.4.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-10-25T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Same-origin policy violation could have leaked cross-origin URLs", "id": "2136156", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2136156"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-829", "details": ["A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4.", "A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a same-origin policy violation that could have allowed the theft of cross-origin URL entries, leaking the result of a redirect via `performance.getEntries()`."], "name": "CVE-2022-42927", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2022-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-42927\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-42927\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-45/#CVE-2022-42927\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-46/#CVE-2022-42927"], "threat_severity": "Important"}

{

acknowledgement : Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges James Lee as the original reporter. (string)

affected_release : [ »

0 : { »

advisory : RHSA-2022:7069 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:102.4.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-10-20T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:7184 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:102.4.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-10-25T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:7070 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:102.4.0-1.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-10-20T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:7190 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:102.4.0-1.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-10-25T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:7066 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:102.4.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-10-20T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:7183 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:102.4.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-10-25T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:7068 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:102.4.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-10-20T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:7182 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:102.4.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-10-25T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:7072 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:102.4.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-10-20T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:7181 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:102.4.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-10-25T00:00:00Z (string)

}

10 : { »

advisory : RHSA-2022:7071 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : firefox-0:102.4.0-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-10-20T00:00:00Z (string)

}

11 : { »

advisory : RHSA-2022:7178 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : thunderbird-0:102.4.0-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-10-25T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: Same-origin policy violation could have leaked cross-origin URLs (string)

id : 2136156 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2136156 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

status : verified (string)

}

cwe : CWE-829 (string)

details : [ »

0 : A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via `performance.getEntries()`. This vulnerability affects Firefox < 106, Firefox ESR < 102.4, and Thunderbird < 102.4. (string)

1 : A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of a same-origin policy violation that could have allowed the theft of cross-origin URL entries, leaking the result of a redirect via `performance.getEntries()`. (string)

]

name : CVE-2022-42927 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

]

public_date : 2022-10-18T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-42927 https://nvd.nist.gov/vuln/detail/CVE-2022-42927 https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/#CVE-2022-42927 https://www.mozilla.org/en-US/security/advisories/mfsa2022-46/#CVE-2022-42927 (string)

]

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object