PT-2019-19973 · Mozilla+1 · Firefox+1

Adrian Karolak · Published 2019-10-22 · Updated 2021-02-18 · CVE-2020-12412

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 70

Description The issue allows an attacker to manipulate the address bar, displaying an incorrect domain with the https:// scheme, a blocked port number, and without a lock icon, while controlling the page contents. This is achieved by navigating a tab using the history API.

Recommendations For versions prior to 70, update to version 70 or later to resolve the issue.

Fix

Related Identifiers

ALT-PU-2019-3087

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

CVE-2020-12412

Affected Products

Alt Linux

Firefox

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2020-12412 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12412 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12412 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12412 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-34 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12412 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2020-12412 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1528587 · Vendor Advisory