CVE-2022-28284

SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1754522	Issue Tracking Permissions Required Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-13/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1754522	Issue Tracking Permissions Required Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-13/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1754522	Issue Tracking Permissions Required Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

History

16 Apr 2025, 14:15

Type	Values Removed	Values Added
CWE		CWE-116
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1754522 - Issue Tracking, Permissions Required, Vendor Advisory~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1754522 - Issue Tracking, Permissions Required, Vendor Advisory

Information

Published : 2022-12-22 20:15

Updated : 2025-04-16 14:15

NVD link : CVE-2022-28284

Mitre link : CVE-2022-28284

CVE.ORG link : CVE-2022-28284

JSON object : View

Products Affected

mozilla

firefox

CWE

NVD-CWE-noinfo CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2022-28284", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-12-22T20:15:24.010", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754522", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-13/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754522", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-13/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754522", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99."}, {"lang": "es", "value": "El elemento <code></code> de SVG podr\u00eda haberse utilizado para cargar contenido inesperado que podr\u00eda haber ejecutado un script en determinadas circunstancias. Si bien la especificaci\u00f3n parece permitir esto, otros navegadores no lo hacen, y los desarrolladores web confiaron en esta propiedad para la seguridad de los scripts, por lo que la implementaci\u00f3n de gecko estaba alineada con la de ellos. Esta vulnerabilidad afecta a Firefox < 99."}], "lastModified": "2025-04-16T14:15:18.720", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A841617D-181C-45FF-868A-33DD504B1BA8", "versionEndExcluding": "99.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}