Vulnerability Name:

CVE-2022-45410 (CCN-240138)

Assigned:2022-11-15
Published:2022-11-15
Updated:2023-01-04
Summary:When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
6.1 Medium (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-1275
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2022-45410

Source: security@mozilla.org
Type: Issue Tracking, Permissions Required, Vendor Advisory
security@mozilla.org

Source: XF
Type: UNKNOWN
mozilla-firefox-cve202245410-sec-bypass(240138)

Source: CCN
Type: IBM Security Bulletin 6849101 (Application Performance Management)
Multiple vulnerabilities of Mozilla Firefox (less than Firefox 102.5ESR) have affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF16

Source: CCN
Type: Mozilla Foundation Security Advisory 2022-47
Security Vulnerabilities fixed in Firefox 107

Source: security@mozilla.org
Type: Vendor Advisory
security@mozilla.org

Source: security@mozilla.org
Type: Vendor Advisory
security@mozilla.org

Source: security@mozilla.org
Type: Vendor Advisory
security@mozilla.org

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*
    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*
    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:*
    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:*
    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:*
    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:*
    • Configuration RedHat 7:
  • cpe:/a:redhat:enterprise_linux:9:*:*:*:*:*:*:*
    • Configuration RedHat 8:
  • cpe:/a:redhat:enterprise_linux:9::appstream:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:ibm:application_performance_management:8.1.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.redhat.rhsa:def:20228580
    P
    		RHSA-2022:8580: firefox security update (Important)
    2022-11-22
    oval:com.redhat.rhsa:def:20228547
    P
    		RHSA-2022:8547: thunderbird security update (Important)
    2022-11-21
    oval:com.redhat.rhsa:def:20228561
    P
    		RHSA-2022:8561: thunderbird security update (Important)
    2022-11-21
    oval:com.redhat.rhsa:def:20228552
    P
    		RHSA-2022:8552: firefox security update (Important)
    2022-11-21
    oval:com.redhat.rhsa:def:20228554
    P
    		RHSA-2022:8554: firefox security update (Important)
    2022-11-21
    oval:com.redhat.rhsa:def:20228555
    P
    		RHSA-2022:8555: thunderbird security update (Important)
    2022-11-21
    BACK
    ibm application performance management 8.1.4