VulnerabilityModified
CVE-2020-15650
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android.
MEDIUM 5.5EPSS 0.64%
Does this matter?
Lower severity and a low EPSS score (0.64%). Track it; it rarely justifies an emergency change on its own.
Description
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 0.64% probability · 48th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox esr
- Source
- security@mozilla.org
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1652360Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2020-31/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1652360Issue Tracking
- https://www.mozilla.org/security/advisories/mfsa2020-31/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.