Vulnerabilities > CVE-2022-40959 - Insecure Storage of Sensitive Information vulnerability in Mozilla Thunderbird

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
mozilla
CWE-922

Summary

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that leaked device permissions into untrusted subdocuments. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.

Vulnerable Configurations

Part Description Count
Application
Mozilla
1505

Common Weakness Enumeration (CWE)