CVE-2022-28284 Cross-site scripting in Firefox
An attacker could execute arbitrary script in Firefox via the SVG use element, bypassing security assumptions relied upon by web developers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-28284?
CVE-2022-28284 is a high-severity cross-site scripting vulnerability in Mozilla Firefox, published on 22 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
SVG's <code><use></code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.
Weakness: CWE-116
Which versions are affected by CVE-2022-28284?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2022-28284?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-28284 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-28284 exists.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-5g34-x2rf-m7v6, UBUNTU-CVE-2022-28284.