PT-2020-16570 · Mozilla+1 · Firefox For Android+1

Muneaki Nishimura · Published 2020-11-21 · Updated 2024-12-12 · CVE-2020-26955

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 83

Description The issue occurs when a user downloads a file in Firefox for Android and a cookie is set. In such cases, the cookie would be re-sent during subsequent file download operations on the same domain, regardless of whether the original and subsequent requests were made in private or non-private browsing modes. This issue is specific to Firefox for Android, with other operating systems being unaffected.

Recommendations For Firefox for Android versions prior to 83, update to version 83 or later to resolve the issue. As a temporary workaround, consider restricting the use of cookies for file download operations or clearing cookies after each download to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-565

Related Identifiers

ALT-PU-2020-3384

ALT-PU-2021-3368

CVE-2020-26955

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Firefox For Android

References · 1889

• https://bugzilla.mozilla.org/show_bug.cgi?id=1663261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26955 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26955 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-26955 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-26955 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-50/#CVE-2020-26955 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-50 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-26955 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2024-2615 · Note
• https://suse.com/security/cve/CVE-2022-38477 · Note
• https://suse.com/security/cve/CVE-2022-28282 · Note
• https://suse.com/security/cve/CVE-2020-35111 · Note
• https://suse.com/security/cve/CVE-2017-5435 · Note