MFSA2020-48: OAuth session fixation vulnerability in Mozilla VPN
Published Nov 4, 2020
·Updated
OAuth session fixation vulnerability in Mozilla VPN
Affected Software
3 affected componentsFixes available
Mozilla Mozilla VPN (929) (iOS)<1.0.7
1.0.7
Mozilla Mozilla VPN (1360) (Android)<1.1.0
1.1.0
Mozilla Mozilla VPN (Windows)<1.2.2
1.2.2
Event History
Nov 4, 2020
Advisory Published
via Mozilla·12:00 AM
Frequently Asked Questions
1
What is the severity of MFSA2020-48?
MFSA2020-48 is classified as a high severity vulnerability affecting OAuth session management.
2
Which versions of Mozilla VPN are affected by MFSA2020-48?
MFSA2020-48 affects Mozilla VPN for Android versions below 1.1.0, iOS versions below 1.0.7, and Windows versions below 1.2.2.
3
How do I fix MFSA2020-48?
To fix MFSA2020-48, update your Mozilla VPN to Android version 1.1.0, iOS version 1.0.7, or Windows version 1.2.2 or later.
4
What type of vulnerability is MFSA2020-48?
MFSA2020-48 is an OAuth session fixation vulnerability that can lead to unauthorized access.
5
Can MFSA2020-48 affect user data?
Yes, MFSA2020-48 can potentially compromise user data by allowing attackers to hijack user sessions.