CVE-2020-12393: Command Injection
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
Other sources
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution.Note: this issue only affects Firefox on Windows operating systems.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-12393?
CVE-2020-12393 is classified as medium severity due to the potential for command injection risks.
How do I fix CVE-2020-12393?
To fix CVE-2020-12393, users should update to the latest versions of Mozilla Firefox or Thunderbird, specifically to Firefox ESR 68.8 or Firefox 76.
What is the impact of CVE-2020-12393?
The impact of CVE-2020-12393 includes the possibility of arbitrary command execution if vulnerable users paste unsafe cURL commands into a terminal.
Which software versions are affected by CVE-2020-12393?
CVE-2020-12393 affects Mozilla Firefox versions prior to 76, Firefox ESR versions prior to 68.8, and Thunderbird versions prior to 68.8.
Who is the vendor of CVE-2020-12393?
The vendor of CVE-2020-12393 is Mozilla, the developer of Firefox and Thunderbird.