PT-2020-13107 · Mozilla · Firefox

Konark Modi + 1 · Published 2020-07-09 · Updated 2020-07-13 · CVE-2020-12414

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 27

Description The issue arises from the incorrect use of the API for WKWebViewConfiguration in private browsing mode, leading to IndexedDB not being cleared when the mode is exited. This requires the private instance of the WKWebViewConfiguration object to be deleted upon leaving private mode.

Recommendations For versions prior to 27, update to version 27 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-459

Related Identifiers

CVE-2020-12414

Affected Products

Firefox

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-12414 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12414 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1646756 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-23 · Vendor Advisory