Permissions, Privileges, and Access Controls in Mozilla Firefox - CVE-2020-6813
Published: March 10, 2020 / Updated: March 10, 2020
Vulnerability identifier: #VU25858
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6813
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy.
Affected software
Mozilla Firefox
Arch Linux
firefox (Ubuntu package)
firefox (Alpine package)
Cloud App Management V2018
Arch Linux
firefox (Ubuntu package)
firefox (Alpine package)
Cloud App Management V2018
How to mitigate CVE-2020-6813
Install updates from vendor's website.
Mozilla Firefox - update to 74.0
firefox (Ubuntu package) - addressed in versions 74.0+build3-0ubuntu0.16.04.1, 74.0+build3-0ubuntu0.18.04.1, 74.0+build3-0ubuntu0.19.10.1
firefox (Alpine package) - update to 74.0-r0
Cloud App Management V2018 - update to 2020.1.0
firefox (Ubuntu package) - addressed in versions 74.0+build3-0ubuntu0.16.04.1, 74.0+build3-0ubuntu0.18.04.1, 74.0+build3-0ubuntu0.19.10.1
firefox (Alpine package) - update to 74.0-r0
Cloud App Management V2018 - update to 2020.1.0