PT-2020-14569 · Mozilla · Firefox For Android

Pedro Oliveira · Published 2020-08-10 · Updated 2020-11-19 · CVE-2020-15647

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to the fixed version

Description A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage, leading to sensitive data disclosure, including cookies for other origins. This issue can be exploited by visiting a malicious website, potentially allowing the theft of cookies.

Recommendations For Firefox for Android versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to sensitive websites until the update is applied. Avoid using Firefox for Android to access sensitive information until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-15647

Affected Products

Firefox For Android

References · 7

• https://osv.dev/vulnerability/CVE-2020-15647 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1647078 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15647 · Security Note
• https://mozilla.org/security/advisories/mfsa2020-27 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2113 · Telegram Post
• https://t.me/thebugbountyhunter/4910 · Telegram Post
• https://t.me/ckure/6056 · Telegram Post