Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-w44g-v7w6-xpcv

Опубликовано: 22 дек. 2022
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

EPSS

Процентиль: 24%
0.0008
Низкий

7.5 High

CVSS3

Дефекты

CWE-367

Связанные уязвимости

CVSS3: 7.5
ubuntu
почти 3 года назад

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

CVSS3: 7.5
redhat
больше 3 лет назад

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

CVSS3: 7.5
nvd
почти 3 года назад

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox < 98, Firefox ESR < 91.7, and Thunderbird < 91.7.

CVSS3: 7.5
debian
почти 3 года назад

When installing an add-on, Firefox verified the signature before promp ...

CVSS3: 5.3
fstec
больше 3 лет назад

Уязвимость браузера Mozilla Firefox, связанная с состоянием гонки при проверке подписей, позволяющая нарушителю выполнить спуфинговую атаку

EPSS

Процентиль: 24%
0.0008
Низкий

7.5 High

CVSS3

Дефекты

CWE-367