CVE-2022-31746CWE-200information-disclosure

CVE-2022-31746

Medium · published December 23, 2022

CVSS v3.1

6.5

EPSS

Percentile

37.5

In the wild

Unconfirmed

What it is

Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.00443 · 37.5th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2022-12-23T01:15Z

Affected products (1)

Product	Versions	Fixed in
mozilla/firefox_mobile	< 102.0	102.0

References (5)

https://bugzilla.mozilla.org/show_bug.cgi?id=1654416 · [email protected]https://www.mozilla.org/security/advisories/mfsa2022-27/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1654416 · af854a3a-2127-422b-91ae-364da2661108 https://www.mozilla.org/security/advisories/mfsa2022-27/ · af854a3a-2127-422b-91ae-364da2661108 https://bugzilla.mozilla.org/show_bug.cgi?id=1654416 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

22 DEC 00:00Z
Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
cvelistv5