{"id":"CVE-2020-15677","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-15677","generatedAt":"2026-10-27T22:33:30.273Z","title":"By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually…","description":"By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.","published":"2020-10-01T19:15:14.000Z","lastModified":"2026-06-17T02:57:02.000Z","status":"Modified","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-601"],"affected":["mozilla/firefox","mozilla/firefox esr","mozilla/thunderbird","debian/debian linux","opensuse/leap"],"epss":{"score":0.01657,"percentile":0.76442,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.66%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html","tags":["Broken Link","Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html","tags":["Broken Link","Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1641487","tags":["Issue Tracking","Permissions Required","Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://security.gentoo.org/glsa/202010-02","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://www.debian.org/security/2020/dsa-4770","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-42/","tags":["Release Notes","Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-43/","tags":["Release Notes","Vendor Advisory"],"source":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-44/","tags":["Release Notes","Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html","tags":["Broken Link","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html","tags":["Broken Link","Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1641487","tags":["Issue Tracking","Permissions Required","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202010-02","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2020/dsa-4770","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-42/","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-43/","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-44/","tags":["Release Notes","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-15677","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}