Log in Start free

Vulnerability · Published Mar 25, 2020 · Assigned by mozilla

CVE-2020-6808

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)1.1%top 34.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.21firefox74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.22firefox74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.23firefox74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.21librewolf74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.22librewolf74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.23librewolf74.0-r0ALPINE-CVE-2020-6808
Alpine:v3.24librewolf74.0-r0ALPINE-CVE-2020-6808

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 74

References