CVE-2022-22753 — Time-of-check Time-of-use (TOCTOU) Race Condition in Mozilla Firefox
Severity
7.1HIGHNVD
EPSS
0.4%
top 38.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 22
Description
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9
Affected Packages6 packages
🔴Vulnerability Details
2GHSA▶
GHSA-pr6h-wqwg-8wxx: A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary director↗2022-12-22
CVEList▶
CVE-2022-22753: A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary director↗2022-12-22
📋Vendor Advisories
5Debian▶
CVE-2022-22753: firefox - A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service tha...↗2022