CVE-2020-6813 — Improper Access Control in Mozilla Firefox

CWE-284 — Improper Access Control9 documents8 sources
Severity
5.3MEDIUMNVD
OSV6.5
EPSS
0.2%
top 61.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedMar 25
Latest updateMay 24

Description

When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages5 packages

▶debiandebian/firefox< firefox 74.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 74
▶NVDmozilla/firefox< 74.0
▶Ubuntumozilla/firefox< 74.0+build3-0ubuntu0.16.04.1+2
▶mozillamozilla/firefox

🔴Vulnerability Details

3
GHSA
GHSA-ghv2-cp6r-w334: When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject↗2022-05-24
▶
OSV
CVE-2020-6813: When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject↗2020-03-11
▶
OSV
firefox vulnerabilities↗2020-03-11
▶

📋Vendor Advisories

4
Ubuntu
Firefox vulnerabilities↗2020-03-11
▶
Red Hat
Mozilla: @import statements in CSS could bypass the Content Security Policy nonce feature↗2020-03-10
▶
Debian
CVE-2020-6813: firefox - When protecting CSS blocks with the nonce feature of Content Security Policy, th...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-08: CVE-2020-6813↗
▶

💬Community

1
Bugzilla
CVE-2020-6813 Mozilla: @import statements in CSS could bypass the Content Security Policy nonce feature↗2020-04-29
▶