CVE-2022-38472

An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104.

• CWE-346
• CWE-346

• https://bugzilla.mozilla.org/show_bug.cgi?id=1769155Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-33/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-34/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-35/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-36/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-37/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1769155Issue Tracking, Permissions Required, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-33/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-34/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-35/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-36/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-37/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38466A vulnerability has been identified in CoreShield One-Way Ga…7.8
• CVE-2022-38467Reflected Cross-Site Scripting (XSS) vulnerability in CRM Pe…6.1
• CVE-2022-38468Cross-Site Request Forgery (CSRF) vulnerability in Imagely W…4.3
• CVE-2022-38469 An unauthorized user with network access and the decrypt…7.5
• CVE-2022-3847The Showing URL in QR Code WordPress plugin through 0.0.1 do…6.1
• CVE-2022-38470Cross-Site Request Forgery (CSRF) vulnerability in Customer …8.8
• CVE-2022-38473A cross-origin iframe referencing an XSLT document would inh…8.8
• CVE-2022-38474A website that had permission to access the microphone could…4.3
• CVE-2022-38475An attacker could have written a value to the first element …6.5
• CVE-2022-38476A data race could occur in the <code>PK11_ChangePW</code> fu…7.5
• CVE-2022-38477Mozilla developer Nika Layzell and the Mozilla Fuzzing Team …8.8
• CVE-2022-38478Members the Mozilla Fuzzing Team reported memory safety bugs…8.8