VDB
CVE-2020-15655
CVE-2020-15655
PUBLISHED
Reported by mozilla · Published August 10, 2020
A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| firefox | Alpine | 79.0-r0 |
| librewolf | Alpine | 79.0-r0 |
| firefox | Arch Linux | 79.0-1 |
| thunderbird | Arch Linux | 68.12.0-1 |
| firefox-esr | Alpine | 78.1.0-r0 |
| thunderbird | mozilla | 78.1 |
| firefox | mozilla | 79.0, 79 |
| thunderbird | Ubuntu:20.04:LTS | 1:78.7.1+build1-0ubuntu0.20.04.1 |
| Firefox ESR | Mozilla | 78.1 |
| firefox | Ubuntu:16.04:LTS | 79.0+build1-0ubuntu0.16.04.2 |
| firefox | Ubuntu:20.04:LTS | 79.0+build1-0ubuntu0.20.04.1 |
| firefox | Ubuntu:18.04:LTS | 79.0+build1-0ubuntu0.18.04.1 |
2 more packages have a fixed version. See every fix in Lookup.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox ESR | unspecified |
| Mozilla | Firefox | unspecified |
| Mozilla | Thunderbird | unspecified |
| alpine | firefox | 0 |
| alpine | librewolf | 0 |
| arch | firefox | 0 |
| Mozilla | Firefox ESR | * |
| arch | thunderbird | 0 |
| Mozilla | Firefox | * |
| Mozilla | Thunderbird | * |
| alpine | firefox-esr | 0 |
Timeline
- Jul 29, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Nov 21, 2024 CVE Updated
- Mar 6, 2026 Distribution Patch
- Mar 6, 2026 Security Advisory (7 in total, the first dated here)
- Sep 4, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-15655
vulnetix vdb fixes CVE-2020-15655Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-15655/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- x_refsource_MISC
- openSUSE-SU-2020:1189 vendor-advisoryx_refsource_SUSE
- USN-4443-1 vendor-advisoryx_refsource_UBUNTU