CVE-2022-34471
Last modified
CVE-2022-34471 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. EPSS estimates a 0.25% chance of exploitation in the next 30 days.
Description
When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 102.0 |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1766047Issue Tracking, Permissions Required, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-24/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1766047Issue Tracking, Permissions Required, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2022-24/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-34471?
How severe is CVE-2022-34471?
How do I fix CVE-2022-34471?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-34466A vulnerability has been identified in Mendix Applications u…6.5
- CVE-2022-34467A vulnerability has been identified in Mendix Excel Importer…6.5
- CVE-2022-34468An iframe that was not permitted to run scripts could do so …8.8
- CVE-2022-34469When a TLS Certificate error occurs on a domain protected by…8.1
- CVE-2022-3447Inappropriate implementation in Custom Tabs in Google Chrome…4.3
- CVE-2022-34470Session history navigations may have led to a use-after-free…9.8
- CVE-2022-34472If there was a PAC URL set and the server that hosts the PAC…4.3
- CVE-2022-34473The HTML Sanitizer should have sanitized the <code>href</cod…6.1
- CVE-2022-34474Even when an iframe was sandboxed with <code>allow-top-navig…6.1
- CVE-2022-34475SVG <code><use></code> tags that referenced a same-ori…6.1
- CVE-2022-34476ASN.1 parsing of an indefinite SEQUENCE inside an indefinite…9.8
- CVE-2022-34477The MediaError message property should be consistent to avoi…7.5
Are you affected by CVE-2022-34471?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST