CVE-2020-15663

Katalog CVE

CVSS 8.8 · High EPSS 2,7%

Kerentanan Uncontrolled Search Path Element pada mozilla firefox, mozilla firefox esr +1 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Rincian

Terbit di NVD

1 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1643199 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-36/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-37/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-38/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-40/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-41/ release notes · advisory vendor