CVEvulnerability
CVE-2020-15677
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-10-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
- Weaknesses
- CWE-601
Description
By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
Affected configurations
• mozilla firefox (< 81.0)
• mozilla firefox esr (< 78.3)
• mozilla thunderbird (< 78.3)
• debian debian linux 9.0
• debian debian linux 10.0
• opensuse leap 15.1
• opensuse leap 15.2
Related
Weakness · CWE (1)
- CWE-601 URL Redirection to Untrusted Site weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html Broken Link, Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html Broken Link, Mailing List, Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1641487 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202010-02 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4770 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-42/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-43/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-44/ Release Notes, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html Broken Link, Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html Broken Link, Mailing List, Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1641487 Issue Tracking, Permissions Required, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202010-02 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4770 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-42/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-43/ Release Notes, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-44/ Release Notes, Vendor Advisory