PT-2020-13103 · Mozilla · Firefox

Vinoth Kumar · Published 2020-07-09 · Updated 2021-07-21 · CVE-2020-12404

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 26

Description The issue arises from the native-to-JS bridging mechanism in the app, which requires a unique token to prevent non-app code from calling bridging functions. However, this token can potentially leak when used for downloading files, thus compromising the security of the bridging process.

Recommendations For versions prior to 26, update to version 26 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-12404

Affected Products

Firefox

References · 5

• https://osv.dev/vulnerability/CVE-2020-12404 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1631739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12404 · Security Note
• https://mozilla.org/security/advisories/mfsa2020-19 · Vendor Advisory
• https://t.me/cibsecurity/13353 · Telegram Post