← back
CVE-2022-28284

CVE-2022-28284

CVSS 8.8 HIGHEPSS 0.5%CWE-116
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
22 Dec 2022Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
SVG's <code>&lt;use&gt;</code> element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with theirs. This vulnerability affects Firefox < 99.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Mozilla · Firefox

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1754522https://www.mozilla.org/security/advisories/mfsa2022-13/