VDB
CVE-2020-15649
CVE-2020-15649
PUBLISHED
CVSS 5.5 MEDIUM
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
EPSS 0.16% · 37.3th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
0.16%
37.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox ESR | * |
| mozilla | firefox_esr | 0 |
| Mozilla | Firefox |
Timeline
- Aug 10, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- May 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-34/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-31/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-32/ advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-30/ advisory
- https://www.mozilla.org/security/advisories/mfsa2020-31/ url
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364 url
- https://nvd.nist.gov/vuln/detail/CVE-2020-15649 advisory
- https://www.mozilla.org/security/advisories/mfsa2020-31 url