CVE-2020-15664

Katalog CVE

CVSS 6.5 · Medium EPSS 1,4%

Kerentanan Incorrect Authorization pada mozilla firefox, mozilla firefox esr +2 lainnya. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80.

Rincian

Terbit di NVD

1 Oktober 2020

Terakhir diubah

19 Agustus 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1658214 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-36/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-37/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-38/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-39/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-40/ advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-41/ advisory vendor