CVE-2022-34471

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 102

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1766047Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-24/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1766047Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2022-24/Vendor Advisory

Timeline

Published: Dec 22, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-344724.3If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrec CVE-2022-344736.1The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did no CVE-2022-344746.1Even when an iframe was sandboxed with <code>allow-top-navigation-by-user-activation</code>, if it received a redirect header to an external CVE-2022-344756.1SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanit CVE-2022-344769.8ASN.1 parsing of an indefinite SEQUENCE inside an indefinite GROUP could have resulted in the parser accepting malformed ASN.1. This vulnera CVE-2022-344777.5The MediaError message property should be consistent to avoid leaking information about cross-origin resources; however for a same-site cros CVE-2022-344786.5The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the CVE-2022-344796.5A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in pot CVE-2022-34488.8Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in speci CVE-2022-344808.8Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been free CVE-2022-344818.8In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the number of elements to repl CVE-2022-344828.8An attacker who could have convinced a user to drag and drop an image to a filesystem could have manipulated the resulting filename to conta