Vulnerability · Published Dec 9, 2020 · Assigned by mozilla

CVE-2020-26955

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)0.8%top 42.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	firefox	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.21	firefox	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.22	firefox	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.23	firefox	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.21	librewolf	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.22	librewolf	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.23	librewolf	83.0-r0	ALPINE-CVE-2020-26955
Alpine:v3.24	librewolf	83.0-r0	ALPINE-CVE-2020-26955

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	< 83

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1663261 x_refsource_MISC
https://www.mozilla.org/security/advisories/mfsa2020-50/ x_refsource_CONFIRM