CVE-2022-38474 - A website that had permission to access the microphone could record audio without the audio notification being shown

Back Back to CVE browser

MEDIUM

A website that had permission to access the microphone could record audio without the audio notification being shown

Published Dec 22, 2022

4.3

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted.<br />*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 104.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <104

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<104

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-668

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=1719511
Issue TrackingPermissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41057
Advisory
https://www.mozilla.org/security/advisories/mfsa2022-33/
Vendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1719511		Issue TrackingPermissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41057		Advisory
https://www.mozilla.org/security/advisories/mfsa2022-33/		Vendor Advisory