VulnerabilityModified
CVE-2020-15649
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android.
MEDIUM 5.5EPSS 0.72%
Does this matter?
Lower severity and a low EPSS score (0.72%). Track it; it rarely justifies an emergency change on its own.
Description
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 0.72% probability · 52th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- mozilla/firefox esr
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-31/Vendor Advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1475835%2C1652364Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-31/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.