CVE-2022-31742

Summary

An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.

Affected Software

VendorProductVersion RangeStatus
MozillaThunderbirdunspecified < 91.10affected
MozillaFirefoxunspecified < 101affected
MozillaFirefox ESRunspecified < 91.10affected

Weaknesses

  • Querying a WebAuthn token with a large number of allowCredential entries may have leaked cross-origin information

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

Additional References

References