CVE-2022-36318 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
thunderbird-0:91.12.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:5773	2022-08-01T00:00:00Z
firefox-0:91.12.0-2.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:5776	2022-08-01T00:00:00Z
Red Hat Enterprise Linux 8
thunderbird-0:91.12.0-1.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:5774	2022-08-01T00:00:00Z
firefox-0:91.12.0-2.el8_6	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:5777	2022-08-01T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:91.12.0-2.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:5766	2022-08-01T00:00:00Z
thunderbird-0:91.12.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:5770	2022-08-01T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
firefox-0:91.12.0-2.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:5765	2022-08-01T00:00:00Z
thunderbird-0:91.12.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:5771	2022-08-01T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:91.12.0-2.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:5769	2022-08-01T00:00:00Z
thunderbird-0:91.12.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:5772	2022-08-01T00:00:00Z
Red Hat Enterprise Linux 9
firefox-0:91.12.0-2.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:5767	2022-08-01T00:00:00Z
thunderbird-0:91.12.0-1.el9_0	cpe:/a:redhat:enterprise_linux:9	RHSA-2022:5778	2022-08-01T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1771774
https://nvd.nist.gov/vuln/detail/CVE-2022-36318
https://www.cve.org/CVERecord?id=CVE-2022-36318
https://www.mozilla.org/en-US/security/advisories/mfsa2022-30/#CVE-2022-36318
https://www.mozilla.org/security/advisories/mfsa2022-28/
https://www.mozilla.org/security/advisories/mfsa2022-29/
https://www.mozilla.org/security/advisories/mfsa2022-30/
https://www.mozilla.org/security/advisories/mfsa2022-31/
https://www.mozilla.org/security/advisories/mfsa2022-32/

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-36318", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-15T17:05:29.632Z", "dateReserved": "2022-07-20T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12."}], "affected": [{"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "102.1", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThan": "91.12", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "103", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "102.1", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThan": "91.12", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-28/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-31/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-30/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-29/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-32/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1771774"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Directory indexes for bundled resources reflected URL parameters"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:00:04.320Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-28/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-31/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-30/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-29/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-32/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1771774", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-15T17:05:19.581153Z", "id": "CVE-2022-36318", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T17:05:29.632Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-36318 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-15T17:05:29.632Z (string)

dateReserved : 2022-07-20T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 102.1 (string)

status : affected (string)

versionType : custom (string)

}

1 : { »

version : unspecified (string)

lessThan : 91.12 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 103 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 102.1 (string)

status : affected (string)

versionType : custom (string)

}

1 : { »

version : unspecified (string)

lessThan : 91.12 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-28/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-31/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-30/ (string)

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-29/ (string)

}

4 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-32/ (string)

}

5 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1771774 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Directory indexes for bundled resources reflected URL parameters (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T10:00:04.320Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-28/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-31/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-30/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-29/ (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-32/ (string)

tags : [ »

0 : x_transferred (string)

]

}

5 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1771774 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-362 (string)

lang : en (string)

description : CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : REQUIRED (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-15T17:05:19.581153Z (string)

id : CVE-2022-36318 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-15T17:05:29.632Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-36318", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-15T17:05:29.632Z", "dateReserved": "2022-07-20T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12."}], "affected": [{"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "102.1", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThan": "91.12", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "103", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "102.1", "status": "affected", "versionType": "custom"}, {"version": "unspecified", "lessThan": "91.12", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-28/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-31/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-30/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-29/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-32/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1771774"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Directory indexes for bundled resources reflected URL parameters"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:00:04.320Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-28/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-31/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-30/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-29/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-32/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1771774", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-36318", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-15T17:05:19.581153Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-15T17:04:16.317Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-36318 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-15T17:05:29.632Z (string)

dateReserved : 2022-07-20T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 102.1 (string)

status : affected (string)

versionType : custom (string)

}

1 : { »

version : unspecified (string)

lessThan : 91.12 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 103 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 102.1 (string)

status : affected (string)

versionType : custom (string)

}

1 : { »

version : unspecified (string)

lessThan : 91.12 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-28/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-31/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-30/ (string)

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-29/ (string)

}

4 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-32/ (string)

}

5 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1771774 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Directory indexes for bundled resources reflected URL parameters (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T10:00:04.320Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-28/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-31/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-30/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-29/ (string)

tags : [ »

0 : x_transferred (string)

]

}

4 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-32/ (string)

tags : [ »

0 : x_transferred (string)

]

}

5 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1771774 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : REQUIRED (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-36318 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-15T17:05:19.581153Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-362 (string)

description : CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-15T17:04:16.317Z (string)

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "462DFC94-393F-4760-9D12-17B8ABBACE5D", "versionEndExcluding": "103.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D1E0075-4AF4-40A8-A08F-E5DF3243810E", "versionEndExcluding": "102.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "8EAC693F-DD6D-4496-A67F-98FE041F03F5", "versionEndExcluding": "102.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "9E4372EA-A0A8-4C33-9A76-5A88161ECE92", "versionEndExcluding": "91.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "6F2DB9F7-9179-4363-9B0A-BCEC16520442", "versionEndExcluding": "91.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12."}, {"lang": "es", "value": "Al visitar listados de directorios para URL `chrome://` como texto fuente, se reflejaron algunos par\u00e1metros. Esta vulnerabilidad afecta a Firefox ESR &lt; 102.1, Firefox ESR &lt; 91.12, Firefox &lt; 103, Thunderbird&lt; 102.1 y Thunderbird &lt; 91.12."}], "id": "CVE-2022-36318", "lastModified": "2025-04-15T17:15:35.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:35.617", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1771774"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-28/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-29/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-30/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-31/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-32/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1771774"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-28/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-29/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-30/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-31/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-32/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 462DFC94-393F-4760-9D12-17B8ABBACE5D (string)

versionEndExcluding : 103.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3D1E0075-4AF4-40A8-A08F-E5DF3243810E (string)

versionEndExcluding : 102.1 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8EAC693F-DD6D-4496-A67F-98FE041F03F5 (string)

versionEndExcluding : 102.1 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 9E4372EA-A0A8-4C33-9A76-5A88161ECE92 (string)

versionEndExcluding : 91.12 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 6F2DB9F7-9179-4363-9B0A-BCEC16520442 (string)

versionEndExcluding : 91.12 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. (string)

}

1 : { »

lang : es (string)

value : Al visitar listados de directorios para URL `chrome://` como texto fuente, se reflejaron algunos parámetros. Esta vulnerabilidad afecta a Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird< 102.1 y Thunderbird < 91.12. (string)

}

]

id : CVE-2022-36318 (string)

lastModified : 2025-04-15T17:15:35.397 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:35.617 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1771774 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-28/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-29/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-30/ (string)

}

4 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-31/ (string)

}

5 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-32/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1771774 (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-28/ (string)

}

8 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-29/ (string)

}

9 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-30/ (string)

}

10 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-31/ (string)

}

11 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-32/ (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-362 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-362 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Gijs Kruitbosch as the original reporter.", "affected_release": [{"advisory": "RHSA-2022:5773", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.12.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5776", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:91.12.0-2.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5774", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.12.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5777", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:91.12.0-2.el8_6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5766", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:91.12.0-2.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5770", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:91.12.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5765", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:91.12.0-2.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5771", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.12.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5769", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:91.12.0-2.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5772", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:91.12.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5767", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "firefox-0:91.12.0-2.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-08-01T00:00:00Z"}, {"advisory": "RHSA-2022:5778", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:91.12.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2022-08-01T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Directory indexes for bundled resources reflected URL parameters", "id": "2111908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2111908"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-79", "details": ["When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12.", "A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting directory listings for `chrome://` URLs as source text, some parameters were reflected."], "name": "CVE-2022-36318", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2022-07-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-36318\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-36318\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-30/#CVE-2022-36318"], "threat_severity": "Moderate"}

{

acknowledgement : Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Gijs Kruitbosch as the original reporter. (string)

affected_release : [ »

0 : { »

advisory : RHSA-2022:5773 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:91.12.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-08-01T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:5776 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:91.12.0-2.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-08-01T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:5774 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:91.12.0-1.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-08-01T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:5777 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:91.12.0-2.el8_6 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-08-01T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:5766 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:91.12.0-2.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-08-01T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:5770 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:91.12.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-08-01T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:5765 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:91.12.0-2.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-08-01T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:5771 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:91.12.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-08-01T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:5769 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:91.12.0-2.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-08-01T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:5772 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:91.12.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-08-01T00:00:00Z (string)

}

10 : { »

advisory : RHSA-2022:5767 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : firefox-0:91.12.0-2.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-08-01T00:00:00Z (string)

}

11 : { »

advisory : RHSA-2022:5778 (string)

cpe : cpe:/a:redhat:enterprise_linux:9 (string)

package : thunderbird-0:91.12.0-1.el9_0 (string)

product_name : Red Hat Enterprise Linux 9 (string)

release_date : 2022-08-01T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: Directory indexes for bundled resources reflected URL parameters (string)

id : 2111908 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2111908 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 6.1 (string)

cvss3_scoring_vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

status : verified (string)

}

cwe : CWE-79 (string)

details : [ »

0 : When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESR < 102.1, Firefox ESR < 91.12, Firefox < 103, Thunderbird < 102.1, and Thunderbird < 91.12. (string)

1 : A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of when visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. (string)

]

name : CVE-2022-36318 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

]

public_date : 2022-07-26T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-36318 https://nvd.nist.gov/vuln/detail/CVE-2022-36318 https://www.mozilla.org/en-US/security/advisories/mfsa2022-30/#CVE-2022-36318 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object