CVE-2020-15660: CSRF
Published Jul 20, 2021
·Updated
Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability, that might, when paired with a specifically prepared request, lead to remote code execution.
Affected Software
1 affected component
Mozilla Geckodriver<0.27.0
Event History
Jul 20, 2021
CVE Published
via MITRE·11:24 AM
Data Sourced
via MITRE·11:24 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-15660?
CVE-2020-15660 has been classified as a high severity vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2020-15660?
To fix CVE-2020-15660, users should update Geckodriver to version 0.27.0 or later.
3
What type of vulnerability is CVE-2020-15660?
CVE-2020-15660 is a Cross-Site Request Forgery (CSRF) vulnerability related to missing checks on Content-Type headers.
4
Which versions of Geckodriver are affected by CVE-2020-15660?
Versions of Geckodriver prior to 0.27.0 are affected by CVE-2020-15660.
5
Can CVE-2020-15660 lead to remote code execution?
Yes, CVE-2020-15660 can lead to remote code execution if exploited with a specifically prepared request.