{"id":"CVE-2022-45418","state":"PUBLISHED","title":"If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing at","description":"If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107.","publishedAt":"2022-12-22T00:00:00.000Z","updatedAt":"2025-04-15T14:46:57.753Z","severity":{"score":6.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","source":"CISA-ADP"},"assigner":"mozilla","products":["Mozilla Firefox ESR","Mozilla Thunderbird","Mozilla Firefox"],"affected":[{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","status":"affected","lessThan":"102.5","versionType":"custom"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","status":"affected","lessThan":"102.5","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"107","versionType":"custom"}]}],"references":["https://www.mozilla.org/security/advisories/mfsa2022-47/","https://www.mozilla.org/security/advisories/mfsa2022-49/","https://www.mozilla.org/security/advisories/mfsa2022-48/","https://bugzilla.mozilla.org/show_bug.cgi?id=1795815"],"weaknesses":["CWE-1021"],"ingestedAt":"2026-10-29T19:50:51.061Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/45xxx/CVE-2022-45418.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-45418","state":"PUBLISHED","datePublished":"2022-12-22T00:00:00.000Z","dateUpdated":"2025-04-15T14:46:57.753Z","assignerShortName":"mozilla","assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateReserved":"2022-11-14T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107."}],"affected":[{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","status":"affected","lessThan":"102.5","versionType":"custom"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","status":"affected","lessThan":"102.5","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"107","versionType":"custom"}]}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-47/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-49/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-48/"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1795815"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"Custom mouse cursor could have been drawn over browser UI"}]}],"providerMetadata":{"shortName":"mozilla","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateUpdated":"2022-12-22T00:00:00.000Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2022-47/","tags":["x_transferred"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-49/","tags":["x_transferred"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2022-48/","tags":["x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1795815","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T14:09:56.990Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1795815","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":6.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-04-15T14:46:53.567993Z","id":"CVE-2022-45418","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1021","type":"CWE","lang":"en","description":"CWE-1021 Improper Restriction of Rendered UI Layers or Frames"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-15T14:46:57.753Z"}}]}}}