---
title: "CVE-2022-3033\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2022-3033?format=md
keywords: index, follow
---

# CVE-2022-3033

Publication date 1 September 2022

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**8.1 · High**

[Score breakdown](https://ubuntu.com/security/CVE-2022-3033?format=md#impact-score)

Toggle side navigation

## Description

If a Thunderbird user replied to a crafted HTML email containing a
<code>meta</code> tag, with the <code>meta</code> tag having the
<code>http-equiv="refresh"</code> attribute, and the content attribute
specifying an URL, then Thunderbird started a network request to that URL,
regardless of the configuration to block remote content. In combination
with certain other HTML elements and attributes in the email, it was
possible to execute JavaScript code included in the message in the context
of the message compose document. The JavaScript code was able to perform
actions including, but probably not limited to, read and modify the
contents of the message compose document, including the quoted original
message, which could potentially contain the decrypted plaintext of
encrypted data in the crafted email. The contents could then be transmitted
to the network, either to the URL specified in the META refresh tag, or to
a different URL, as the JavaScript code could modify the URL specified in
the document. This bug doesn't affect users who have changed the default
Message Body display setting to 'simple html' or 'plain text'. This
vulnerability affects Thunderbird < 102.2.1 and Thunderbird < 91.13.1.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| thunderbird | 23.04 lunar | Not affected |
| 22.10 kinetic | Ignored end of life, was needs-triage |
| 22.04 LTS jammy | Fixed 1:102.2.2+build1-0ubuntu0.22.04.1 |
| 20.04 LTS focal | Fixed 1:102.2.2+build1-0ubuntu0.20.04.1 |
| 18.04 LTS bionic | Fixed 1:102.2.2+build1-0ubuntu0.18.04.1 |
| 16.04 LTS xenial | Ignored end of standard support |
| 14.04 LTS trusty | Ignored end of standard support |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

8.1 · High

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | Required |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 8.1 · High |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3033)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-3033)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-3033)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2022-3033)

### Related Ubuntu Security Notices (USN)

+ [USN-5663-1](https://usn.ubuntu.com/USN-5663-1)
+ Thunderbird vulnerabilities
+ 7 October 2022

### Other references

* <https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/#CVE-2022-3033>
* <https://www.cve.org/CVERecord?id=CVE-2022-3033>