Log in Start free

Vulnerability · Published Apr 24, 2020 · Assigned by mozilla

CVE-2020-6824

Low 2.8

In plain English

A low-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)2.8Low
Exploit odds (30 days)0.3%top 80.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Initially, a user opens a Private Browsing Window and generates a password for a site, then closes the Private Browsing Window but leaves Firefox open. Subsequently, if the user had opened a new Private Browsing Window, revisited the same site, and generated a new password - the generated passwords would have been identical, rather than independent. This vulnerability affects Firefox < 75.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.21firefox75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.22firefox75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.23firefox75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.21librewolf75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.22librewolf75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.23librewolf75.0-r0ALPINE-CVE-2020-6824
Alpine:v3.24librewolf75.0-r0ALPINE-CVE-2020-6824

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 75

References