CVE-2022-1802
Published: 22 December 2022
Summary
CVE-2022-1802 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Mozilla Firefox. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-1802 is a prototype pollution flaw in JavaScript handling that allows an attacker to corrupt methods on an Array object. Successful exploitation grants execution of attacker-controlled code in a privileged context. The issue affects Firefox ESR versions prior to 91.9.1, Firefox versions prior to 100.0.2, Firefox for Android versions prior to 100.3.0, and Thunderbird versions prior to 91.9.1.
An attacker can trigger the flaw by supplying malicious input that pollutes the prototype chain, after which arbitrary JavaScript runs with elevated privileges. The attack requires user interaction such as visiting a crafted web page and carries a CVSS 3.1 score of 8.8.
Mozilla security advisories MFSA2022-19 and the associated Bugzilla entries direct users to apply the fixed releases listed above. The EPSS score remains flat at its peak value of 0.6793 with no material post-disclosure increase.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-25081
Vulnerability details
If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox <…
more
100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.