PT-2020-6727 · Mozilla · Firefox For Ios

Muneaki Nishimura · Published 2020-07-28 · Updated 2021-01-09 · CVE-2020-15661

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 28

Description The issue is related to insufficient protection of registration data, allowing a rogue webpage to override the injected WKUserScript used by the logins autofill. This could result in leaking a password for the current domain. A remote attacker may exploit this to gain access to user passwords for the current domain.

Recommendations For Firefox for iOS versions prior to 28, update to version 28 or later to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2022-05803

CVE-2020-15661

Affected Products

Firefox For Ios

References · 8

• https://bugzilla.mozilla.org/show_bug.cgi?id=1654131 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-34 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15661 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15661 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05803 · Security Note
• https://mozilla.org/security/advisories/mfsa2020-34 · Vendor Advisory
• https://cybersecurity-help.cz/vulnerabilities/32932 · Note
• https://t.me/cybersecuritytechnologies/2462 · Telegram Post