{
  "cveId": "CVE-2022-46873",
  "url": "https://patchblox.com/security/cve/CVE-2022-46873",
  "summary": "CVE-2022-46873 is fixed in 5 products on 2 platforms, first by firefox 108.0\u002Bbuild2-0ubuntu0.18.04.1, released December 13, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Mozilla Firefox and 2 others: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
  "description": "Because Firefox did not implement the \u003Ccode\u003Eunsafe-hashes\u003C/code\u003E CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject executable script. This would be severely constrained by the specified Content Security Policy of the document. This vulnerability affects Firefox \u003C 108.",
  "published": "2022-12-13T16:00:00Z",
  "severity": "Medium",
  "cvss": 8.8,
  "cwe": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
  "epss": 0.00749,
  "epssPercentile": 0.55162,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2022-46873",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Mozilla Firefox (en-US)",
      "fixedVersion": "108.0",
      "fix": "Mozilla Firefox (en-US) 108.0",
      "url": "https://patchblox.com/security/fix/windows-app/mozilla.firefox-108.0",
      "released": "2022-12-14T00:00:00Z"
    },
    {
      "platform": "windows-app",
      "product": "Mozilla Firefox ESR (en-US)",
      "fixedVersion": "115.4.0",
      "fix": "Mozilla Firefox ESR (en-US) 115.4.0",
      "url": "https://patchblox.com/security/fix/windows-app/mozilla.firefox.esr-115.4.0",
      "released": "2023-10-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "108.0\u002Bbuild2-0ubuntu0.18.04.1",
      "fix": "firefox 108.0\u002Bbuild2-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-108.0-build2-0ubuntu0.18.04.1",
      "released": "2022-12-13T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "108.0\u002Bbuild2-0ubuntu0.20.04.1",
      "fix": "firefox 108.0\u002Bbuild2-0ubuntu0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-108.0-build2-0ubuntu0.20.04.1",
      "released": "2022-12-13T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-geckodriver",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "108.0\u002Bbuild2-0ubuntu0.18.04.1",
      "fix": "firefox-geckodriver 108.0\u002Bbuild2-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-geckodriver-108.0-build2-0ubuntu0.18.04.1",
      "released": "2022-12-13T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-geckodriver",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "108.0\u002Bbuild2-0ubuntu0.20.04.1",
      "fix": "firefox-geckodriver 108.0\u002Bbuild2-0ubuntu0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-geckodriver-108.0-build2-0ubuntu0.20.04.1",
      "released": "2022-12-13T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "108.0\u002Bbuild2-0ubuntu0.18.04.1",
      "fix": "firefox-mozsymbols 108.0\u002Bbuild2-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-mozsymbols-108.0-build2-0ubuntu0.18.04.1",
      "released": "2022-12-13T16:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "108.0\u002Bbuild2-0ubuntu0.20.04.1",
      "fix": "firefox-mozsymbols 108.0\u002Bbuild2-0ubuntu0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-mozsymbols-108.0-build2-0ubuntu0.20.04.1",
      "released": "2022-12-13T16:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}