Spoofing attack in Mozilla Firefox - CVE-2020-12408
Published: June 2, 2020 / Updated: July 15, 2020
Vulnerability identifier: #VU28526
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-12408
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data when browsing a document hosted on an IP address. A remote attacker can trick the victim to visit a specially crafted website and flip flip domain and path information in the address bar.
Affected software
Mozilla Firefox
Arch Linux
Gentoo Linux
firefox (Alpine package)
Arch Linux
Gentoo Linux
firefox (Alpine package)
How to mitigate CVE-2020-12408
Install updates from vendor's website.
Mozilla Firefox - update to 77.0
firefox (Alpine package) - update to 77.0-r0
firefox (Alpine package) - update to 77.0-r0