CVE-2020-26951 — Cross-site Scripting in Mozilla Firefox
CWE-79 — Cross-site ScriptingCWE-354 — Improper Validation of Integrity Check Value12 documents8 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 37.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 9
Latest updateMay 24
Description
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7
Affected Packages7 packages
🔴Vulnerability Details
3GHSA▶
GHSA-w7p8-wf2r-rw5h: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization↗2022-05-24
CVEList▶
CVE-2020-26951: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization↗2020-12-09
OSV▶
CVE-2020-26951: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization↗2020-12-09