CVE-2022-34478: mozilla firefox Open Redirect
Vulnerability summary
CVE-2022-34478 is a medium (CVSS 6.5) Open Redirect vulnerability in mozilla firefox. EPSS estimates a 0.78% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 11 · Related 11Timeline
- 22-12-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.78%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.78% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla3 products
- firefox≥ unspecified, < 102 | < 102.0
- firefox_esr≥ unspecified, < 91.11 | < 91.11
- thunderbird≥ unspecified, < 102 | ≥ unspecified, < 91.11 | < 91.11
1 vendor · 3 products
References
4 links- www.mozilla.org/security/advisories/mfsa2022-24/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2022-26/Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2022-25/Vendor Advisory