CVE-2020-15653 — Incorrect Default Permissions in Mozilla Firefox
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 48.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 10
Latest updateMay 24
Description
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages8 packages
Also affects: Ubuntu Linux 16.04, 18.04, 20.04
🔴Vulnerability Details
4GHSA▶
GHSA-vcgf-4q4f-3267: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links↗2022-05-24
CVEList▶
CVE-2020-15653: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links↗2020-08-10
OSV▶
CVE-2020-15653: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links↗2020-07-29
📋Vendor Advisories
6Debian▶
CVE-2020-15653: firefox - An iframe sandbox element with the allow-popups flag could be bypassed when usin...↗2020