Spoofing attack in Mozilla Firefox - CVE-2020-15682
Published: October 20, 2020
Vulnerability identifier: #VU47745
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-15682
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data. When a link to an external protocol was clicked, a prompt was presented
that allowed the user to choose what application to open it in. An
attacker could induce that prompt to be associated with an origin they
didn't control, resulting in a spoofing attack.
Affected software
Mozilla Firefox
Arch Linux
Ubuntu
firefox (Alpine package)
firefox (Ubuntu package)
Arch Linux
Ubuntu
firefox (Alpine package)
firefox (Ubuntu package)
How to mitigate CVE-2020-15682
Install updates from vendor's website.
Mozilla Firefox - update to 82.0
firefox (Ubuntu package) - addressed in versions 82.0+build2-0ubuntu0.16.04.5, 82.0+build2-0ubuntu0.18.04.1, 82.0+build2-0ubuntu0.20.04.1, 82.0+build2-0ubuntu0.20.10.1
firefox (Ubuntu package) - addressed in versions 82.0+build2-0ubuntu0.16.04.5, 82.0+build2-0ubuntu0.18.04.1, 82.0+build2-0ubuntu0.20.04.1, 82.0+build2-0ubuntu0.20.10.1