#VU32903 Input validation error in Mozilla Firefox and Firefox ESR - CVE-2020-15658
Published: July 29, 2020
Vulnerability identifier: #VU32903
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-15658
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mozilla Firefox
Firefox ESR
Mozilla Firefox
Firefox ESR
Software vendor:
Mozilla
Mozilla
Description
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to insufficient validation of special characters during file download,
which led to an attacker being able to cut off the file ending at an
earlier position, leading to a different file type being downloaded than
shown in the dialog. A remote attacker can override file type when saving data to disk.
Remediation
Install updates from vendor's website.