Vulnerability identifier: #VU29576
Vulnerability risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-264
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Firefox for Android
Mobile applications /
Apps for mobile phones
Vendor: Mozilla
Description
The vulnerability allows a remote attacker to gain access to sensitive information.
A Content Provider in Firefox for Android allowed local files accessible by the browser to be read by a remote webpage. A remote attacker can create a specially crafted web page, trick the victim into opening it and read sensitive information on de device, including cookies for other origins.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
Firefox for Android: 68.0 - 68.10.0
External links
http://www.mozilla.org/en-US/security/advisories/mfsa2020-27/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.