CVE-2020-15679
First published: Wed Nov 04 2020(Updated: )
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Mozilla VPN Android (1360) | <1.1.0 | 1.1.0 |
| Mozilla Mozilla VPN iOS (929) | <1.0.7 | 1.0.7 |
| Mozilla Mozilla VPN Windows | <1.2.2 | 1.2.2 |
| Mozilla Vpn | <1.0.7_\(929\) | |
| Mozilla VPN Windows | <1.2.2 | |
| Mozilla Vpn | >=1.0.7<1.0.7_\(929\) | |
| Mozilla VPN Android | >=1.1.0<1.1.0_\(1360\) |
Remedy
https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39ac173665fad3f2598b54
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/mozilla-services/guardian-vpn-windows/commit/ac6f562973a83f6758cd7ab7aa313e863047d41b
- https://github.com/mozilla-mobile/guardian-vpn-android/commit/981c840276ef3aee98cf5d42993d484ee99b28d9
- https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39ac173665fad3f2598b54
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-48/
- https://www.mozilla.org/security/advisories/mfsa2020-48/
Frequently Asked Questions
What is CVE-2020-15679?
CVE-2020-15679 is an OAuth session fixation vulnerability in the VPN login flow where an attacker can craft a custom login URL and obtain authenticated access as a VPN user.
What is the severity of CVE-2020-15679?
The severity of CVE-2020-15679 is medium, with a severity value of 4.
Which software versions are affected by CVE-2020-15679?
CVE-2020-15679 affects Mozilla VPN Android (1360) version up to, but exclusive, 1.1.0, Mozilla VPN iOS (929) version up to, but exclusive, 1.0.7, and Mozilla VPN Windows version up to, but exclusive, 1.2.2.
How can an attacker exploit CVE-2020-15679?
An attacker can exploit CVE-2020-15679 by crafting a custom login URL, convincing a VPN user to login via that URL, and obtaining authenticated access as that user.
Where can I find more information about CVE-2020-15679?
You can find more information about CVE-2020-15679 at the following references: [link1], [link2], [link3].
- collector/mozilla-advisory
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- source/Mozilla
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/remedy
- agent/weakness
- agent/author
- agent/event
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/mozilla
- canonical/mozilla mozilla vpn android (1360)
- canonical/mozilla mozilla vpn ios (929)
- canonical/mozilla mozilla vpn windows
- canonical/mozilla vpn
- canonical/mozilla vpn windows
- version/mozilla vpn/1.0.7
- canonical/mozilla vpn android
- version/mozilla vpn android/1.1.0