CVE-2020-12424 — Incorrect Default Permissions in Mozilla Firefox

CWE-276 — Incorrect Default PermissionsCWE-451 — User Interface (UI) Misrepresentation of Critical Information11 documents9 sources
Severity
6.5MEDIUMNVD
EPSS
0.2%
top 63.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla ThunderbirdOpensuse Leap
Timeline
PublishedJul 9
Latest updateMay 24

Description

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 78
▶NVDmozilla/firefox< 78.0
▶Ubuntumozilla/firefox< 78.0.1+build1-0ubuntu0.16.04.1+2
▶Ubuntumozilla/thunderbird< 1:78.8.1+build1-0ubuntu0.18.04.1+1
▶NVDopensuse/leap15.1, 15.2+1

🔴Vulnerability Details

4
GHSA
GHSA-2cqw-c249-qrpc: When constructing a permission prompt for WebRTC, a URI was supplied from the content process↗2022-05-24
▶
CVEList
CVE-2020-12424: When constructing a permission prompt for WebRTC, a URI was supplied from the content process↗2020-07-09
▶
OSV
firefox vulnerabilities↗2020-07-02
▶
OSV
CVE-2020-12424: When constructing a permission prompt for WebRTC, a URI was supplied from the content process↗2020-07-01
▶

📋Vendor Advisories

5
Ubuntu
Firefox vulnerabilities↗2020-07-02
▶
Red Hat
Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process↗2020-06-30
▶
Debian
CVE-2020-12424: firefox - When constructing a permission prompt for WebRTC, a URI was supplied from the co...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-29: CVE-2020-12424↗
▶
Mozilla
Mozilla Foundation Security Advisory 2020-24: CVE-2020-12424↗
▶

💬Community

1
Bugzilla
CVE-2020-12424 Mozilla: WebRTC permission prompt could have been bypassed by a compromised content process↗2020-08-26
▶
CVE-2020-12424 — Incorrect Default Permissions | cvebase