PT-2022-8577 · Mozilla · Vpn

Published 2022-12-22 · Updated 2022-12-29 · CVE-2020-15679

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Mozilla VPN iOS versions 1.0.7 and earlier Mozilla VPN Windows versions prior to 1.2.2 Mozilla VPN Android versions 1.1.0 and earlier

Description An issue existed in the VPN login flow, where an attacker could craft a custom login URL and convince a VPN user to login via that URL, obtaining authenticated access as that user. This issue is limited to cases where the attacker and victim share the same source IP and could allow the ability to view session states and disconnect VPN sessions.

Recommendations For Mozilla VPN iOS versions 1.0.7 and earlier, update to a version later than 1.0.7. For Mozilla VPN Windows versions prior to 1.2.2, update to version 1.2.2 or later. For Mozilla VPN Android versions 1.1.0 and earlier, update to a version later than 1.1.0.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2020-15679

Affected Products

Vpn

References · 6

• https://github.com/mozilla-mobile/guardian-vpn-android/commit/981c840276ef3aee98cf5d42993d484ee99b28d9 · Patch
• https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39ac173665fad3f2598b54 · Patch
• https://github.com/mozilla-services/guardian-vpn-windows/commit/ac6f562973a83f6758cd7ab7aa313e863047d41b · Patch
• https://mozilla.org/security/advisories/mfsa2020-48 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15679 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15679 · Security Note