PT-2019-19973 · Mozilla+1 · Firefox+1

Adrian Karolak · Publicado 2019-10-22 · Atualizado 2021-02-18 · CVE-2020-12412

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 70

Description The issue allows an attacker to manipulate the address bar, displaying an incorrect domain with the https:// scheme, a blocked port number, and without a lock icon, while controlling the page contents. This is achieved by navigating a tab using the history API.

Recommendations For versions prior to 70, update to version 70 or later to resolve the issue.

Correção

Identificadores relacionados

ALT-PU-2019-3087

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

CVE-2020-12412

Produtos afetados

Alt Linux

Firefox

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-12412 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2020-12412 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2020-12412 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12412 · Aviso do Fabricante
• https://mozilla.org/security/advisories/mfsa2019-34 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2020-12412 · Aviso do Fabricante
• https://mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2020-12412 · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=1528587 · Aviso do Fabricante