CVE-2020-12392: Path Traversal
Last updated 24 July 2024
Other sources
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 130.0-2 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 115.14.0esr-1~deb11u1Fixed in 115.15.0esr-1~deb11u1Fixed in 115.14.0esr-1~deb12u1Fixed in 115.15.0esr-1~deb12u1Fixed in 115.15.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:115.12.0-1~deb11u1Fixed in 1:115.15.0-1~deb11u1Fixed in 1:115.12.0-1~deb12u1Fixed in 1:115.15.0-1~deb12u1Fixed in 1:128.1.1esr-1Fixed in 1:128.2.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 76 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 68.8 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 76.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 68.8.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 76.0-r0 - Upgrade
Upgrade
alpine/mozjs68to a version that resolves this vulnerability.Fixed in 68.8.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 68.8.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-12392?
CVE-2020-12392 has been classified as a moderate severity vulnerability.
How do I fix CVE-2020-12392?
To fix CVE-2020-12392, users should update to the latest version of Firefox or Thunderbird that exceeds the affected versions listed.
What products are affected by CVE-2020-12392?
CVE-2020-12392 affects Mozilla Firefox ESR, Mozilla Thunderbird, and certain versions of Firefox.
What type of vulnerability is CVE-2020-12392?
CVE-2020-12392 is a security flaw related to improper handling of HTTP POST data in the 'Copy as cURL' feature of browser devtools.
What could be the impact of exploiting CVE-2020-12392?
Exploiting CVE-2020-12392 could potentially lead to the disclosure of sensitive information if a user inadvertently runs a pasted curl command.