CVE-2020-12424

EUVD-2020-4736 · Published Jul 9, 2020

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78.

Technologies

Opensuse LeapMozilla Firefox

Weaknesses

CWE-276

CVSS scores

v3.16.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
v2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Execution Stealth Discovery

T1190Exploit Public-Facing Application T1083File and Directory Discovery T1574.010Services File Permissions Weakness

References

http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1562600
https://security.gentoo.org/glsa/202007-10
https://www.mozilla.org/security/advisories/mfsa2020-24/

Potentially impacted assets

See if this affects your attack surface