Weak password requirements in Mozilla Firefox - CVE-2020-6824
Published: April 7, 2020
Vulnerability identifier: #VU26652
CSH Severity: Low
CVSS v4: 1 [CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6824
CWE-ID: CWE-521
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to another user password.
The vulnerability exists due to incorrect behavior of password generator when private browsing mode is user. If the victim had used password generator in a Private Browsing Window to generate a password and then closed the private window while leaving Firefox open, the attacker can open another private browsing session, visit the same website and Firefox will generate identical password.
Affected software
Mozilla Firefox
Gentoo Linux
Arch Linux
firefox (Ubuntu package)
firefox (Alpine package)
Gentoo Linux
Arch Linux
firefox (Ubuntu package)
firefox (Alpine package)
How to mitigate CVE-2020-6824
Install updates from vendor's website.
Mozilla Firefox - update to 75.0
firefox (Ubuntu package) - addressed in versions 75.0+build3-0ubuntu0.16.04.1, 75.0+build3-0ubuntu0.18.04.1, 75.0+build3-0ubuntu0.19.10.1
firefox (Alpine package) - update to 75.0-r0
firefox (Ubuntu package) - addressed in versions 75.0+build3-0ubuntu0.16.04.1, 75.0+build3-0ubuntu0.18.04.1, 75.0+build3-0ubuntu0.19.10.1
firefox (Alpine package) - update to 75.0-r0