CVE-2020-15677

Katalog CVE

CVSS 6.1 · Medium EPSS 1,7%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada mozilla firefox, mozilla firefox esr +3 lainnya. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Rincian

Terbit di NVD

1 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.mozilla.org/show_bug.cgi?id=1641487 issue tracking · permissions required · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-42/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-43/ release notes · advisory vendor
• https://www.mozilla.org/security/advisories/mfsa2020-44/ release notes · advisory vendor
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html broken link · mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html broken link · mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202010-02 advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4770 advisory pihak ketiga