CVE-2022-34471

6.5 mediumEPSS 0.3%

Medium (6.5) in mozilla firefox. EPSS 0.3% chance of exploitation in the next 30 days.

When downloading an update for an addon, the downloaded addon update's version was not verified to match the version selected from the manifest. If the manifest had been tampered with on the server, an attacker could trick the browser into downgrading the addon to a prior version. This vulnerability affects Firefox < 102.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-345
Published: 2022-12-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:firefox

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1766047
https://www.mozilla.org/security/advisories/mfsa2022-24/
https://bugzilla.mozilla.org/show_bug.cgi?id=1766047
https://www.mozilla.org/security/advisories/mfsa2022-24/

Check your stack JSON