CVE-2020-15671CWE-200CWE-362information-disclosure

CVE-2020-15671

Low · published October 1, 2020

CVSS v3.1

3.1

EPSS

Percentile

41.3

In the wild

Unconfirmed

What it is

When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting in the typed password being saved to the keyboard dictionary. This vulnerability affects Firefox for Android < 80.

The record

Technical detail

CVSS v3.1: 3.1 · LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00492 · 41.3th percentile
Weaknesses: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published: 2020-10-01T23:15Z

Affected products (1)

Product	Versions	Fixed in
mozilla/firefox_mobile	< 80.0	80.0

References (4)

https://bugzilla.mozilla.org/show_bug.cgi?id=1653862 · [email protected]https://www.mozilla.org/security/advisories/mfsa2020-39/ · [email protected]https://bugzilla.mozilla.org/show_bug.cgi?id=1653862 · af854a3a-2127-422b-91ae-364da2661108 https://www.mozilla.org/security/advisories/mfsa2020-39/ · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

01 OCT 18:41Z
When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input field, resulting…
cvelistv5