CVE-2020-15664CWE-863broken-access-control

CVE-2020-15664

Medium · published October 1, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01389 · 72.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2020-10-01T23:15Z
Affected products (6)
ProductVersionsFixed in
mozilla/firefox< 80.080.0
mozilla/firefox≥ 78.0, < 78.278.2
mozilla/firefox_esr< 68.1268.12
mozilla/firefox_mobile< 80.080.0
mozilla/thunderbird< 68.1268.12
mozilla/thunderbird≥ 78.0, < 78.278.2
References (14)
https://bugzilla.mozilla.org/show_bug.cgi?id=1658214 · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-36/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-37/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-38/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-39/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-40/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-41/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1658214 · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-36/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-37/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-38/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-39/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-40/ · af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2020-41/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 01 OCT 18:43Z
    By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would…
    cvelistv5