Security features bypass in Mozilla Firefox - CVE-2022-28284
Published: April 5, 2022
Vulnerability identifier: #VU61888
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-28284
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to an error that allowed the SVG's <use> element to load unexpected content and execute it under certain circumstances. A remote attacker can bypass implemented security restrictions and execute arbitrary JavaScript code in victim's browser.
Affected software
Mozilla Firefox
Gentoo Linux
Ubuntu
firefox (Ubuntu package)
Gentoo Linux
Ubuntu
firefox (Ubuntu package)
How to mitigate CVE-2022-28284
Install updates from vendor's website.
Mozilla Firefox - update to 99.0
firefox (Ubuntu package) - addressed in versions 99.0+build2-0ubuntu0.18.04.2, 99.0+build2-0ubuntu0.20.04.2, 99.0+build2-0ubuntu0.21.10.2
firefox (Ubuntu package) - addressed in versions 99.0+build2-0ubuntu0.18.04.2, 99.0+build2-0ubuntu0.20.04.2, 99.0+build2-0ubuntu0.21.10.2