CVE-2022-34471

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest

Medium · published December 22, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Published
2022-12-22T00:00Z
EPSS history
Timeline
  • 22 DEC 00:00Z
    When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest
    cvelistv5