Vulnerability · Published Dec 22, 2022 · Assigned by mozilla
CVE-2022-34478
Medium 6.5
In plain English
A medium-severity open redirect in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.21 | firefox | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.22 | firefox | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.23 | firefox | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.20 | firefox-esr | 91.11.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.21 | firefox-esr | 91.11.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.22 | firefox-esr | 91.11.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.23 | firefox-esr | 91.11.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.21 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.22 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.23 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.24 | librewolf | 102.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.20 | thunderbird | 102.0-r0, 102.1.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.21 | thunderbird | 102.0-r0, 102.1.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.22 | thunderbird | 102.0-r0, 102.1.0-r0 | ALPINE-CVE-2022-34478 |
| Alpine:v3.23 | thunderbird | 102.0-r0, 102.1.0-r0 | ALPINE-CVE-2022-34478 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified – before 102 |
| Mozilla | Firefox ESR | unspecified – before 91.11 |
| Mozilla | Thunderbird | unspecified – before 102unspecified – before 91.11 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N