CVE-2020-15661CWE-522

CVE-2020-15661

Medium · published August 10, 2020

CVSS v3.1

6.5

EPSS

Percentile

57.8

In the wild

Unconfirmed

What it is

A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00852 · 57.8th percentile
Weakness: CWE-522 · Insufficiently Protected Credentials
Published: 2020-08-10T22:15Z

Affected products (1)

Product	Versions	Fixed in
mozilla/firefox_mobile	< 28.0	28.0

References (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=1654131 · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-34/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1654131 · af854a3a-2127-422b-91ae-364da2661108 https://www.mozilla.org/security/advisories/mfsa2020-34/ · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

10 AUG 17:43Z
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain
cvelistv5