vulnerability

Rocky Linux: CVE-2022-45410: firefox (Multiple Advisories)

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:M/Au:N/C:N/I:C/A:N)

Published

Dec 22, 2022

Added

Mar 12, 2024

Modified

Mar 31, 2026

Description

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

Solutions

rocky-upgrade-firefoxrocky-upgrade-firefox-debuginforocky-upgrade-firefox-debugsourcerocky-upgrade-thunderbirdrocky-upgrade-thunderbird-debuginforocky-upgrade-thunderbird-debugsource

References

CVE-2022-45410
https://attackerkb.com/topics/CVE-2022-45410
CWE-862
EUVD-EUVD-2022-48282
https://errata.rockylinux.org/RLSA-2022:8547
https://errata.rockylinux.org/RLSA-2022:8554
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-48282

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report