Back
CVE-2022-22753
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an…
High7.1EPSS 0.65%
- Published
- Updated
- Reserved
- Assigned by
- mozilla
Description
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.<br>*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.65% · top 49% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.
Weakness
- Privilege Escalation to SYSTEM on Windows via Maintenance Service
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition (opens in a new tab)All about CWE-367 and its CVEs
Affected products
- affected unspecified – < 97
- affected unspecified – < 91.6
- affected unspecified – < 91.6
References (4)
- https://www.mozilla.org/security/advisories/mfsa2022-05/ (opens in a new tab)x_transferred
- https://www.mozilla.org/security/advisories/mfsa2022-04/ (opens in a new tab)x_transferred
- https://www.mozilla.org/security/advisories/mfsa2022-06/ (opens in a new tab)x_transferred
- https://bugzilla.mozilla.org/show_bug.cgi?id=1732435 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-22753)Record last updated .