CVE-2022-38474

A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted.<br />*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 104.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1719511	Issue Tracking Permissions Required Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-33/	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1719511	Issue Tracking Permissions Required Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-33/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*

History

21 Nov 2024, 07:16

Type	Values Removed	Values Added
References	~~() https://bugzilla.mozilla.org/show_bug.cgi?id=1719511 - Issue Tracking, Permissions Required, Vendor Advisory~~	() https://bugzilla.mozilla.org/show_bug.cgi?id=1719511 - Issue Tracking, Permissions Required, Vendor Advisory
References	~~() https://www.mozilla.org/security/advisories/mfsa2022-33/ - Vendor Advisory~~	() https://www.mozilla.org/security/advisories/mfsa2022-33/ - Vendor Advisory

Information

Published : 2022-12-22 20:15

Updated : 2024-11-21 07:16

NVD link : CVE-2022-38474

Mitre link : CVE-2022-38474

CVE.ORG link : CVE-2022-38474

JSON object : View

Products Affected

mozilla

firefox

CWE

CWE-668

Exposure of Resource to Wrong Sphere

{"id": "CVE-2022-38474", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-12-22T20:15:36.733", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1719511", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-33/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1719511", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-33/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted.<br />*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 104."}, {"lang": "es", "value": "Un sitio web que tuviera permiso para acceder al micr\u00f3fono podr\u00eda grabar audio sin que se mostrara la notificaci\u00f3n de audio. Este error no permite que el atacante omita la solicitud de permiso; solo afecta la notificaci\u00f3n que se muestra una vez que se ha otorgado el permiso.<br>*Este error solo afecta a Firefox para Android. Otros sistemas operativos no se ven afectados.*. Esta vulnerabilidad afecta a Firefox < 104."}], "lastModified": "2024-11-21T07:16:33.003", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "A50D55C9-94FC-487C-967C-F892F348B0BC", "versionEndExcluding": "104.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}