PT-2020-19238 · Mozilla+2 · Firefox+2

Avi Drissman · Published 2020-03-10 · Updated 2024-12-12 · CVE-2020-6810

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 74

Description A issue exists where a website in fullscreen mode can use a previously opened popup to obscure the notification indicating the browser is in fullscreen mode. When combined with spoofing the browser chrome, this can confuse the user about the current origin of the page, potentially leading to credential theft or other attacks.

Recommendations For Firefox versions prior to 74, update to version 74 or later to resolve the issue.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

ALT-PU-2020-1486

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2020-3442

ALT-PU-2021-1368

ALT-PU-2021-3368

CVE-2020-6810

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-4299-1

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1895

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://cve.org/CVERecord?id=CVE-2020-6810 · Security Note
• https://mozilla.org/security/advisories/mfsa2020-08 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-08/#CVE-2020-6810 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6806 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6808 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6807 · Vendor Advisory