{
  "cveId": "CVE-2022-28284",
  "url": "https://patchblox.com/security/cve/CVE-2022-28284",
  "summary": "CVE-2022-28284 is fixed in 5 products on 2 platforms, first by Mozilla Firefox (en-US) 99.0, released April 5, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Mozilla Firefox ESR and 2 others: Improper Encoding or Escaping of Output",
  "description": "SVG\u0027s \u003Ccode\u003E\u0026lt;use\u0026gt;\u003C/code\u003E element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko\u0027s implementation was aligned with theirs. This vulnerability affects Firefox \u003C 99.",
  "published": "2022-04-06T17:00:00Z",
  "severity": "Medium",
  "cvss": 8.8,
  "cwe": "CWE-116: Improper Encoding or Escaping of Output",
  "epss": 0.00585,
  "epssPercentile": 0.48185,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2022-28284",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Mozilla Firefox (en-US)",
      "fixedVersion": "99.0",
      "fix": "Mozilla Firefox (en-US) 99.0",
      "url": "https://patchblox.com/security/fix/windows-app/mozilla.firefox-99.0",
      "released": "2022-04-05T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "Mozilla Firefox ESR (en-US)",
      "fixedVersion": "102.0",
      "fix": "Mozilla Firefox ESR (en-US) 102.0",
      "url": "https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr-102.0",
      "released": "2022-06-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "99.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox 99.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-99.0-build2-0ubuntu0.18.04.2",
      "released": "2022-04-06T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "99.0\u002Bbuild2-0ubuntu0.20.04.2",
      "fix": "firefox 99.0\u002Bbuild2-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-99.0-build2-0ubuntu0.20.04.2",
      "released": "2022-04-06T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:1snap1-0ubuntu1",
      "fix": "firefox 1:1snap1-0ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-firefox-1-1snap1-0ubuntu1",
      "released": "2022-04-06T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-geckodriver",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "99.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox-geckodriver 99.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-geckodriver-99.0-build2-0ubuntu0.18.04.2",
      "released": "2022-04-06T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-geckodriver",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "99.0\u002Bbuild2-0ubuntu0.20.04.2",
      "fix": "firefox-geckodriver 99.0\u002Bbuild2-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-geckodriver-99.0-build2-0ubuntu0.20.04.2",
      "released": "2022-04-06T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "99.0\u002Bbuild2-0ubuntu0.18.04.2",
      "fix": "firefox-mozsymbols 99.0\u002Bbuild2-0ubuntu0.18.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-mozsymbols-99.0-build2-0ubuntu0.18.04.2",
      "released": "2022-04-06T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "99.0\u002Bbuild2-0ubuntu0.20.04.2",
      "fix": "firefox-mozsymbols 99.0\u002Bbuild2-0ubuntu0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-mozsymbols-99.0-build2-0ubuntu0.20.04.2",
      "released": "2022-04-06T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}