CVE-2022-22763 - Vulnerability Details

Vendors	Products
Mozilla	Firefox Firefox Esr Thunderbird
Redhat	Enterprise Linux Rhel E4s Rhel Eus

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 7
firefox-0:91.6.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:0514	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el7_9	cpe:/o:redhat:enterprise_linux:7	RHSA-2022:0538	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8
firefox-0:91.6.0-1.el8_5	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:0510	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_5	cpe:/a:redhat:enterprise_linux:8	RHSA-2022:0535	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
firefox-0:91.6.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:0513	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_1	cpe:/a:redhat:rhel_e4s:8.1	RHSA-2022:0539	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8.2 Extended Update Support
firefox-0:91.6.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:0512	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_2	cpe:/a:redhat:rhel_eus:8.2	RHSA-2022:0537	2022-02-15T00:00:00Z
Red Hat Enterprise Linux 8.4 Extended Update Support
firefox-0:91.6.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:0511	2022-02-14T00:00:00Z
thunderbird-0:91.6.0-1.el8_4	cpe:/a:redhat:rhel_eus:8.4	RHSA-2022:0536	2022-02-15T00:00:00Z

Link	Providers
https://bugzilla.mozilla.org/show_bug.cgi?id=1740534
https://nvd.nist.gov/vuln/detail/CVE-2022-22763
https://www.cve.org/CVERecord?id=CVE-2022-22763
https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22763
https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22763
https://www.mozilla.org/security/advisories/mfsa2022-01/
https://www.mozilla.org/security/advisories/mfsa2022-05/
https://www.mozilla.org/security/advisories/mfsa2022-06/

Type	Values Removed	Values Added
Weaknesses		CWE-362
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-22763", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "dateUpdated": "2025-04-16T14:29:54.217Z", "dateReserved": "2022-01-07T00:00:00.000Z", "datePublished": "2022-12-22T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6."}], "affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"version": "unspecified", "lessThan": "96", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"version": "unspecified", "lessThan": "91.6", "status": "affected", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"version": "unspecified", "lessThan": "91.6", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Script Execution during invalid object state"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:21:49.151Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T14:29:50.622565Z", "id": "CVE-2022-22763", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:29:54.217Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-22763 (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

assignerShortName : mozilla (string)

dateUpdated : 2025-04-16T14:29:54.217Z (string)

dateReserved : 2022-01-07T00:00:00.000Z (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

}

]

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 96 (string)

status : affected (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.6 (string)

status : affected (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

version : unspecified (string)

lessThan : 91.6 (string)

status : affected (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : Script Execution during invalid object state (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:21:49.151Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-362 (string)

lang : en (string)

description : CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (string)

}

]

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

tags : [ »

0 : exploit (string)

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.8 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-16T14:29:50.622565Z (string)

id : CVE-2022-22763 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T14:29:54.217Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/", "tags": ["x_transferred"]}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/", "tags": ["x_transferred"]}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T03:21:49.151Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-22763", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T14:29:50.622565Z"}}}], "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:29:45.582Z"}}], "cna": {"affected": [{"vendor": "Mozilla", "product": "Firefox", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "96", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.6", "versionType": "custom"}]}, {"vendor": "Mozilla", "product": "Firefox ESR", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "91.6", "versionType": "custom"}]}], "references": [{"url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534"}], "descriptions": [{"lang": "en", "value": "When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Script Execution during invalid object state"}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2022-12-22T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-22763", "state": "PUBLISHED", "dateUpdated": "2025-04-16T14:29:54.217Z", "dateReserved": "2022-01-07T00:00:00.000Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2022-12-22T00:00:00.000Z", "assignerShortName": "mozilla"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

tags : [ »

0 : x_transferred (string)

]

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

tags : [ »

0 : x_transferred (string)

]

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T03:21:49.151Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.8 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-22763 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-16T14:29:50.622565Z (string)

}

]

references : [ »

0 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

tags : [ »

0 : exploit (string)

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-362 (string)

description : CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-16T14:29:45.582Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Mozilla (string)

product : Firefox (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 96 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : Mozilla (string)

product : Thunderbird (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.6 (string)

versionType : custom (string)

}

]

}

2 : { »

vendor : Mozilla (string)

product : Firefox ESR (string)

versions : [ »

0 : { »

status : affected (string)

version : unspecified (string)

lessThan : 91.6 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

1 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

2 : { »

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

3 : { »

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : Script Execution during invalid object state (string)

}

]

}

]

providerMetadata : { »

orgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

shortName : mozilla (string)

dateUpdated : 2022-12-22T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-22763 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-16T14:29:54.217Z (string)

dateReserved : 2022-01-07T00:00:00.000Z (string)

assignerOrgId : f16b083a-5664-49f3-a51e-8d479e5ed7fe (string)

datePublished : 2022-12-22T00:00:00.000Z (string)

assignerShortName : mozilla (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "473CF696-0664-4239-995D-D4700507DD1A", "versionEndExcluding": "96.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "47FA8B4B-E1E9-47E3-89E2-16B66FC1F3F6", "versionEndExcluding": "91.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "7310C774-9E33-4B34-83CE-CA2FB0032F01", "versionEndExcluding": "91.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6."}, {"lang": "es", "value": "Cuando se apaga un trabajador, era posible hacer que el script se ejecutara tarde en el ciclo de vida, en un punto posterior al que no deber\u00eda ser posible. Esta vulnerabilidad afecta a Firefox &lt; 96, Thunderbird&lt; 91.6 y Firefox ESR &lt; 91.6."}], "id": "CVE-2022-22763", "lastModified": "2025-04-16T15:15:49.963", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-22T20:15:20.483", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 473CF696-0664-4239-995D-D4700507DD1A (string)

versionEndExcluding : 96.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 47FA8B4B-E1E9-47E3-89E2-16B66FC1F3F6 (string)

versionEndExcluding : 91.6 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 7310C774-9E33-4B34-83CE-CA2FB0032F01 (string)

versionEndExcluding : 91.6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

}

1 : { »

lang : es (string)

value : Cuando se apaga un trabajador, era posible hacer que el script se ejecutara tarde en el ciclo de vida, en un punto posterior al que no debería ser posible. Esta vulnerabilidad afecta a Firefox < 96, Thunderbird< 91.6 y Firefox ESR < 91.6. (string)

}

]

id : CVE-2022-22763 (string)

lastModified : 2025-04-16T15:15:49.963 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2022-12-22T20:15:20.483 (string)

references : [ »

0 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

}

1 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

2 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

3 : { »

source : security@mozilla.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-01/ (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-05/ (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.mozilla.org/security/advisories/mfsa2022-06/ (string)

}

8 : { »

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://bugzilla.mozilla.org/show_bug.cgi?id=1740534 (string)

}

]

sourceIdentifier : security@mozilla.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-362 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2022:0514", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:91.6.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0538", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:91.6.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0510", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:91.6.0-1.el8_5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0535", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:91.6.0-1.el8_5", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0513", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "firefox-0:91.6.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0539", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "thunderbird-0:91.6.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0512", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:91.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0537", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:91.6.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2022-02-15T00:00:00Z"}, {"advisory": "RHSA-2022:0511", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "firefox-0:91.6.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-02-14T00:00:00Z"}, {"advisory": "RHSA-2022:0536", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "thunderbird-0:91.6.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-02-15T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Script Execution during invalid object state", "id": "2053240", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2053240"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-94", "details": ["When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6.", "The Mozilla Foundation Security Advisory describes this flaw as:\nWhen a worker was shut down, it was possible to cause the script to run late in the lifecycle, at a point where it should not be possible."], "name": "CVE-2022-22763", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2022-02-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-22763\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-22763\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22763\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22763"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2022:0514 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : firefox-0:91.6.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-02-14T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:0538 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : thunderbird-0:91.6.0-1.el7_9 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2022-02-15T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:0510 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : firefox-0:91.6.0-1.el8_5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-02-14T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:0535 (string)

cpe : cpe:/a:redhat:enterprise_linux:8 (string)

package : thunderbird-0:91.6.0-1.el8_5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

release_date : 2022-02-15T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:0513 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : firefox-0:91.6.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-02-14T00:00:00Z (string)

}

5 : { »

advisory : RHSA-2022:0539 (string)

cpe : cpe:/a:redhat:rhel_e4s:8.1 (string)

package : thunderbird-0:91.6.0-1.el8_1 (string)

product_name : Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions (string)

release_date : 2022-02-15T00:00:00Z (string)

}

6 : { »

advisory : RHSA-2022:0512 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : firefox-0:91.6.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-02-14T00:00:00Z (string)

}

7 : { »

advisory : RHSA-2022:0537 (string)

cpe : cpe:/a:redhat:rhel_eus:8.2 (string)

package : thunderbird-0:91.6.0-1.el8_2 (string)

product_name : Red Hat Enterprise Linux 8.2 Extended Update Support (string)

release_date : 2022-02-15T00:00:00Z (string)

}

8 : { »

advisory : RHSA-2022:0511 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : firefox-0:91.6.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-02-14T00:00:00Z (string)

}

9 : { »

advisory : RHSA-2022:0536 (string)

cpe : cpe:/a:redhat:rhel_eus:8.4 (string)

package : thunderbird-0:91.6.0-1.el8_4 (string)

product_name : Red Hat Enterprise Linux 8.4 Extended Update Support (string)

release_date : 2022-02-15T00:00:00Z (string)

}

]

bugzilla : { »

description : Mozilla: Script Execution during invalid object state (string)

id : 2053240 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2053240 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 8.8 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

status : verified (string)

}

cwe : CWE-94 (string)

details : [ »

0 : When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6. (string)

1 : The Mozilla Foundation Security Advisory describes this flaw as: When a worker was shut down, it was possible to cause the script to run late in the lifecycle, at a point where it should not be possible. (string)

]

name : CVE-2022-22763 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

1 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Out of support scope (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

2 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : firefox (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

3 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : thunderbird (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

]

public_date : 2022-02-08T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-22763 https://nvd.nist.gov/vuln/detail/CVE-2022-22763 https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/#CVE-2022-22763 https://www.mozilla.org/en-US/security/advisories/mfsa2022-06/#CVE-2022-22763 (string)

]

statement : Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. (string)

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation poc

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object