CVE-2022-34478

MEDIUM EXPLOITED IN THE WILD

Firefox < 102.0 and Firefox ESR < 91.11 - URL Redirection to Untrusted Site via ms-msdt, search, and search-ms Protocols

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-34478 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io).

Description

The <code>ms-msdt</code>, <code>search</code>, and <code>search-ms</code> protocols deliver content to Microsoft applications, bypassing the browser, when a user accepts a prompt. These applications have had known vulnerabilities, exploited in the wild (although we know of none exploited through Thunderbird), so in this release Thunderbird has blocked these protocols from prompting the user to open them.<br>*This bug only affects Thunderbird on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0015
EPSS Percentile 34.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2022-06-15
InTheWild.io 2022-12-22
CWE
CWE-601
Status published
Products (3)
mozilla/firefox < 102.0
mozilla/firefox_esr < 91.11
mozilla/thunderbird < 91.11
Published Dec 22, 2022
Tracked Since Feb 18, 2026