CVE-2022-45410

MEDIUM

Firefox < 107.0 and Firefox ESR < 102.5 - Missing Authorization via ServiceWorker FetchEvent

Title source: llm
STIX 2.1

Description

When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0015
EPSS Percentile 35.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
mozilla/firefox < 107.0
mozilla/firefox_esr < 102.5
mozilla/thunderbird < 102.5
Published Dec 22, 2022
Tracked Since Feb 18, 2026