Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-22753

A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.

Published

2022-12-22T20:15:17.607

Last Modified

2025-04-16T15:15:48.227

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.1 (HIGH)

Weaknesses

Type: Primary
CWE-367
Type: Secondary
CWE-367

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	< 97.0	Yes
Application	mozilla	firefox_esr	< 91.6	Yes
Application	mozilla	thunderbird	< 91.6	Yes
Operating System	microsoft	windows	-	No

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1732435 Exploit, Issue Tracking, Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2022-04/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2022-05/ Vendor Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2022-06/ Vendor Advisory ([email protected])
https://bugzilla.mozilla.org/show_bug.cgi?id=1732435 Exploit, Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2022-04/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2022-05/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.mozilla.org/security/advisories/mfsa2022-06/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)