Ubuntu.comUB:CVE-2022-34471CVE-2022-34471
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
33.2%
When downloading an update for an addon, the downloaded addon update’s
version was not verified to match the version selected from the manifest.
If the manifest had been tampered with on the server, an attacker could
trick the browser into downgrading the addon to a prior version. This
vulnerability affects Firefox < 102.
Notes
| Author | Note |
|---|---|
| mdeslaur | starting with Ubuntu 22.04, the firefox package is just a script that installs the Firefox snap |
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
33.2%