CVE-2022-3033
Vulnerability from cvelistv5
Published
2022-12-22 00:00
Modified
2024-08-03 00:53
Severity ?
Summary
If a Thunderbird user replied to a crafted HTML email containing a <code>meta</code> tag, with the <code>meta</code> tag having the <code>http-equiv="refresh"</code> attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn't affect users who have changed the default Message Body display setting to 'simple html' or 'plain text'. This vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.
References
security@mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1784838Issue Tracking, Permissions Required, Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2022-38/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2022-39/Vendor Advisory
Impacted products
MozillaThunderbird
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:53:00.849Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-38/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2022-39/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1784838"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "102.2.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "91.13.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If a Thunderbird user replied to a crafted HTML email containing a \u003ccode\u003emeta\u003c/code\u003e tag, with the \u003ccode\u003emeta\u003c/code\u003e tag having the \u003ccode\u003ehttp-equiv=\"refresh\"\u003c/code\u003e attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn\u0027t affect users who have changed the default Message Body display setting to \u0027simple html\u0027 or \u0027plain text\u0027. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Leaking of sensitive information when composing a response to an HTML email with a META refresh tag",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-22T00:00:00",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-38/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2022-39/"
        },
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1784838"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2022-3033",
    "datePublished": "2022-12-22T00:00:00",
    "dateReserved": "2022-08-29T00:00:00",
    "dateUpdated": "2024-08-03T00:53:00.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-3033\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2022-12-22T20:15:37.947\",\"lastModified\":\"2023-08-08T14:22:24.967\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"If a Thunderbird user replied to a crafted HTML email containing a \u003ccode\u003emeta\u003c/code\u003e tag, with the \u003ccode\u003emeta\u003c/code\u003e tag having the \u003ccode\u003ehttp-equiv=\\\"refresh\\\"\u003c/code\u003e attribute, and the content attribute specifying an URL, then Thunderbird started a network request to that URL, regardless of the configuration to block remote content. In combination with certain other HTML elements and attributes in the email, it was possible to execute JavaScript code included in the message in the context of the message compose document. The JavaScript code was able to perform actions including, but probably not limited to, read and modify the contents of the message compose document, including the quoted original message, which could potentially contain the decrypted plaintext of encrypted data in the crafted email. The contents could then be transmitted to the network, either to the URL specified in the META refresh tag, or to a different URL, as the JavaScript code could modify the URL specified in the document. This bug doesn\u0027t affect users who have changed the default Message Body display setting to \u0027simple html\u0027 or \u0027plain text\u0027. This vulnerability affects Thunderbird \u003c 102.2.1 and Thunderbird \u003c 91.13.1.\"},{\"lang\":\"es\",\"value\":\"Si un usuario de Thunderbird respondi\u00f3 a un correo electr\u00f3nico HTML manipulado que contiene una etiqueta \u003ccode\u003emeta\u003c/code\u003e, y la etiqueta \u003ccode\u003emeta\u003c/code\u003e tiene el atributo \u003ccode\u003ehttp-equiv=\\\"refresh\\\"\u003c/code\u003e , y el atributo de contenido que especifica una URL, Thunderbird inici\u00f3 una solicitud de red a esa URL, independientemente de la configuraci\u00f3n para bloquear contenido remoto. En combinaci\u00f3n con otros elementos y atributos HTML del correo electr\u00f3nico, era posible ejecutar el c\u00f3digo JavaScript incluido en el mensaje en el contexto del documento de redacci\u00f3n del mensaje. El c\u00f3digo JavaScript pudo realizar acciones que incluyen, entre otras, leer y modificar el contenido del documento de redacci\u00f3n del mensaje, incluido el mensaje original citado, que potencialmente podr\u00eda contener el texto plano descifrado de los datos cifrados en el correo electr\u00f3nico elaborado. Luego, el contenido podr\u00eda transmitirse a la red, ya sea a la URL especificada en la etiqueta de actualizaci\u00f3n META o a una URL diferente, ya que el c\u00f3digo JavaScript podr\u00eda modificar la URL especificada en el documento. Este error no afecta a los usuarios que han cambiado la configuraci\u00f3n predeterminada de visualizaci\u00f3n del cuerpo del mensaje a \\\"html simple\\\" o \\\"texto plano\\\". Esta vulnerabilidad afecta a Thunderbird \u0026lt; 102.2.1 y Thunderbird \u0026lt; 91.13.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"91.13.1\",\"matchCriteriaId\":\"76F28FD2-6BE5-43C4-93B5-051739E3600E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"102.0\",\"versionEndExcluding\":\"102.2.1\",\"matchCriteriaId\":\"576EEF40-52A5-4876-843C-2648CBA74475\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1784838\",\"source\":\"security@mozilla.org\",\"tags\":[\"Issue Tracking\",\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2022-38/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2022-39/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.