CVE-2020-15666: Medium severity Mozilla Firefox vulnerability
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 80 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 80.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 80.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-15666.
What is the severity of CVE-2020-15666?
The severity of CVE-2020-15666 is medium with a CVSS score of 6.5.
Which software products are affected by CVE-2020-15666?
Mozilla Firefox version 80 and Google Android are affected by CVE-2020-15666.
How does CVE-2020-15666 impact users?
CVE-2020-15666 can lead to the disclosure of exact status codes, which can enable attackers to infer login status.
How can I fix CVE-2020-15666?
Update Mozilla Firefox to version 80 or later to fix CVE-2020-15666.