CVE-2022-45410

Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.0

Review impact separately from score.

Published · November 15, 2022

Updated · November 21, 2025

Description

The Mozilla Foundation Security Advisory describes this flaw as: When a ServiceWorker intercepted a request with FetchEvent, the origin of the request was lost after the ServiceWorker took ownership of it. This had the effect of negating SameSite cookie protections. This was addressed in the spec and then in browsers.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-1275 · Sensitive Cookie with Improper SameSite Attribute