CVE-2022-26387

Katalog CVE

CVSS 7.5 · High EPSS 0,65%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada mozilla firefox, mozilla firefox esr +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

Rincian

Terbit di NVD

22 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1752979 exploit · issue tracking · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-10/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-11/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2022-12/ advisory vendor