Log in Start free

Vulnerability · Published Oct 22, 2020 · Assigned by mozilla

CVE-2020-15682

Medium 6.5

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.5%top 58.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that prompt to be associated with an origin they didn't control, resulting in a spoofing attack. This was fixed by changing external protocol prompts to be tab-modal while also ensuring they could not be incorrectly associated with a different origin. This vulnerability affects Firefox < 82.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.21firefox82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.22firefox82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.23firefox82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.21librewolf82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.22librewolf82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.23librewolf82.0-r0ALPINE-CVE-2020-15682
Alpine:v3.24librewolf82.0-r0ALPINE-CVE-2020-15682

Affected products (as reported)

VendorProductVersions
Mozilla Firefox unspecified – before 82

References