{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T13:26:34.576","vulnerabilities":[{"cve":{"id":"CVE-2022-28281","sourceIdentifier":"security@mozilla.org","published":"2022-12-22T20:15:23.023","lastModified":"2026-06-17T04:38:19.400","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent process, an out of bounds write would have occurred leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8."},{"lang":"es","value":"Si un proceso de contenido comprometido envió una cantidad inesperada de extensiones WebAuthN en un comando de registro al proceso principal, se habría producido una escritura fuera de los límites que provocaría daños en la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Thunderbird &lt; 91.8, Firefox &lt; 99 y Firefox ESR &lt; 91.8."}],"affected":[{"source":"security@mozilla.org","affectedData":[{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","lessThan":"91.8","versionType":"custom","status":"affected"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","lessThan":"99","versionType":"custom","status":"affected"}]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","lessThan":"91.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-15T20:09:48.553815Z","id":"CVE-2022-28281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-787"}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"99.0","matchCriteriaId":"A841617D-181C-45FF-868A-33DD504B1BA8"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*","versionEndExcluding":"91.8","matchCriteriaId":"AB18B69A-EE03-4E15-A9AA-FCF442042761"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"91.8","matchCriteriaId":"9DCED53B-8838-45E1-A516-90C99C7DF6F9"}]}]}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1755621","source":"security@mozilla.org","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-13/","source":"security@mozilla.org","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-14/","source":"security@mozilla.org","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-15/","source":"security@mozilla.org","tags":["Exploit","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1755621","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-13/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-14/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-15/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]}]}}]}