CVE-2022-22753

CVSS V2 None CVSS V3 None
Description
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Overview
  • CVE ID
  • CVE-2022-22753
  • Assigner
  • security@mozilla.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-12-22T20:15:17
  • Last Modified Date
  • 2022-12-29T23:03:01
Weakness Enumerations
CWE URL
CWE-367 http://cwe.mitre.org/data/definitions/367.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* 1 OR 97.0
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* 1 OR 91.6
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* 1 OR 91.6
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* 0 OR
References
Reference URL Reference Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1732435
https://www.mozilla.org/security/advisories/mfsa2022-04/
https://www.mozilla.org/security/advisories/mfsa2022-05/
https://www.mozilla.org/security/advisories/mfsa2022-06/
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-22753
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22753
History
Created Old Value New Value Data Type Notes
2022-12-22 20:16:10 Added to TrackCVE
2022-12-22 22:15:10 2022-12-22T21:43:11 CVE Modified Date updated
2022-12-22 22:15:10 Received Awaiting Analysis Vulnerability Status updated
2022-12-27 11:16:01 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2022-12-29 23:14:39 2022-12-29T23:03:01 CVE Modified Date updated
2022-12-29 23:14:39 Undergoing Analysis Analyzed Vulnerability Status updated
2022-12-29 23:14:39 Weakness Enumeration new
2022-12-29 23:14:41 CPE Information updated