CVE-2020-6823 PUBLISHED

A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75.

EPSS 0.92% · 75.8th percentile

Risk Scores

EPSS Score
0.92%
75.8th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSfirefox62.0+build2-0ubuntu0.16.04.3, 41.0.2+build2-0ubuntu1, 42.0+build2-0ubuntu1
Ubuntu:18.04:LTSmozjs5252.3.1-0ubuntu3, 52.3.1-7fakesync1, 52.9.1-0ubuntu0.18.04.1
Ubuntu:20.04:LTSmozjs5252.9.1-1ubuntu3, 0, 52.9.1-1build1
Ubuntu:20.04:LTSmozjs680, *, 68.6.0-1
Ubuntu:18.04:LTSmozjs38*, 0, *
Ubuntu:18.04:LTSfirefox66.0.3+build1-0ubuntu0.18.04.1, 0, 66.0.5+build1-0ubuntu0.18.04.1
Ubuntu:20.04:LTSfirefox73.0.1+build1-0ubuntu1, 74.0+build1-0ubuntu1, 74.0+build2-0ubuntu1

Timeline

References

Open in Interactive Console →