Search for vulnerabilities
Vulnerability details: VCID-pzjg-36vq-gycd
Vulnerability ID VCID-pzjg-36vq-gycd
Aliases CVE-2022-31738
Summary When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1021 Improper Restriction of Rendered UI Layers or Frames
CWE-290 Authentication Bypass by Spoofing
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31738.json
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00094 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
epss 0.00097 https://api.first.org/data/v1/epss?cve=CVE-2022-31738
cvssv3.1 6.5 https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.5 https://nvd.nist.gov/vuln/detail/CVE-2022-31738
archlinux High https://security.archlinux.org/AVG-2760
archlinux High https://security.archlinux.org/AVG-2761
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2022-20
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2022-21
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2022-22
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2022-20/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2022-20/
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2022-21/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2022-21/
cvssv3.1 6.5 https://www.mozilla.org/security/advisories/mfsa2022-22/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2022-22/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31738.json
https://api.first.org/data/v1/epss?cve=CVE-2022-31738
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1529
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1802
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1834
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31736
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31737
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31738
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31740
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31741
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31742
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31747
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
2092021 https://bugzilla.redhat.com/show_bug.cgi?id=2092021
AVG-2760 https://security.archlinux.org/AVG-2760
AVG-2761 https://security.archlinux.org/AVG-2761
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2022-31738 https://nvd.nist.gov/vuln/detail/CVE-2022-31738
mfsa2022-20 https://www.mozilla.org/en-US/security/advisories/mfsa2022-20
mfsa2022-20 https://www.mozilla.org/security/advisories/mfsa2022-20/
mfsa2022-21 https://www.mozilla.org/en-US/security/advisories/mfsa2022-21
mfsa2022-21 https://www.mozilla.org/security/advisories/mfsa2022-21/
mfsa2022-22 https://www.mozilla.org/en-US/security/advisories/mfsa2022-22
mfsa2022-22 https://www.mozilla.org/security/advisories/mfsa2022-22/
RHSA-2022:4870 https://access.redhat.com/errata/RHSA-2022:4870
RHSA-2022:4871 https://access.redhat.com/errata/RHSA-2022:4871
RHSA-2022:4872 https://access.redhat.com/errata/RHSA-2022:4872
RHSA-2022:4873 https://access.redhat.com/errata/RHSA-2022:4873
RHSA-2022:4875 https://access.redhat.com/errata/RHSA-2022:4875
RHSA-2022:4876 https://access.redhat.com/errata/RHSA-2022:4876
RHSA-2022:4887 https://access.redhat.com/errata/RHSA-2022:4887
RHSA-2022:4888 https://access.redhat.com/errata/RHSA-2022:4888
RHSA-2022:4889 https://access.redhat.com/errata/RHSA-2022:4889
RHSA-2022:4890 https://access.redhat.com/errata/RHSA-2022:4890
RHSA-2022:4891 https://access.redhat.com/errata/RHSA-2022:4891
RHSA-2022:4892 https://access.redhat.com/errata/RHSA-2022:4892
show_bug.cgi?id=1756388 https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
USN-5475-1 https://usn.ubuntu.com/5475-1/
USN-5512-1 https://usn.ubuntu.com/5512-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-31738.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T13:54:02Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1756388
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-31738
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Found at https://www.mozilla.org/security/advisories/mfsa2022-20/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T13:54:02Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-20/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Found at https://www.mozilla.org/security/advisories/mfsa2022-21/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T13:54:02Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-21/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Found at https://www.mozilla.org/security/advisories/mfsa2022-22/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-16T13:54:02Z/ Found at https://www.mozilla.org/security/advisories/mfsa2022-22/
Exploit Prediction Scoring System (EPSS)
Percentile 0.27443
EPSS Score 0.00094
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:05.378245+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2022/mfsa2022-21.yml 37.0.0