CVE-2022-22757
Last modified
CVE-2022-22757 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. <br>*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 97.0 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1720098Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-04/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1720098Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-04/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-22757?
How severe is CVE-2022-22757?
How do I fix CVE-2022-22757?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-22751Mozilla developers Calixte Denizet, Kershaw Chang, Christian…8.8
- CVE-2022-22752Mozilla developers Christian Holler and Jason Kratzer report…8.8
- CVE-2022-22753A Time-of-Check Time-of-Use bug existed in the Maintenance (…7.1
- CVE-2022-22754If a user installed an extension of a particular type, the e…6.5
- CVE-2022-22755By using XSL Transforms, a malicious webserver could have se…8.8
- CVE-2022-22756If a user was convinced to drag and drop an image to their d…8.8
- CVE-2022-22758When clicking on a tel: link, USSD codes, specified after a …8.8
- CVE-2022-22759If a document created a sandboxed iframe without <code>allow…9.6
- CVE-2022-2276The WP Edit Menu WordPress plugin before 1.5.0 does not have…4.3
- CVE-2022-22760When importing resources using Web Workers, error messages w…6.5
- CVE-2022-22761Web-accessible extension pages (pages with a moz-extension:/…8.8
- CVE-2022-22762Under certain circumstances, a JavaScript alert (or prompt) …4.3
Are you affected by CVE-2022-22757?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST