CVE-2020-6809 — Files or Directories Accessible to External Parties in Mozilla Firefox

CWE-552 — Files or Directories Accessible to External PartiesCWE-200 — Sensitive Information Exposure9 documents8 sources
Severity
7.5HIGHNVD
OSV6.5
EPSS
0.5%
top 35.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedMar 25
Latest updateMay 24

Description

When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firefox < 74.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶debiandebian/firefox< firefox 74.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 74
▶NVDmozilla/firefox< 74.0
▶Ubuntumozilla/firefox< 74.0+build3-0ubuntu0.16.04.1+2
▶mozillamozilla/firefox

🔴Vulnerability Details

3
GHSA
GHSA-2m96-7r2c-fq6j: When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to r↗2022-05-24
▶
OSV
firefox vulnerabilities↗2020-03-11
▶
OSV
CVE-2020-6809: When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to r↗2020-03-10
▶

📋Vendor Advisories

4
Ubuntu
Firefox vulnerabilities↗2020-03-11
▶
Red Hat
Mozilla: Web Extensions with the all-urls permission could access local files↗2020-03-10
▶
Debian
CVE-2020-6809: firefox - When a Web Extension had the all-urls permission and made a fetch request with a...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-08: CVE-2020-6809↗
▶

💬Community

1
Bugzilla
CVE-2020-6809 Mozilla: Web Extensions with the all-urls permission could access local files↗2020-04-29
▶