A vulnerability classified as critical has been found in Mozilla Firefox up to 77.x (Web Browser). Affected is an unknown code block of the component WebRTC. The manipulation with an unknown input leads to a default permission vulnerability. CWE is classifying the issue as CWE-276. During installation, installed file permissions are set to allow anyone to modify those files. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78.

The weakness was released 07/09/2020 as Bug 1562600 as not defined bug report (Bugzilla). The advisory is available at bugzilla.mozilla.org. This vulnerability is traded as CVE-2020-12424 since 04/28/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/10/2020). This vulnerability is assigned to T1222 by the MITRE ATT&CK project.

Upgrading to version 78.0 eliminates this vulnerability.

Entries connected to this vulnerability are available at 157808, 157807, 157805 and 157804.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 77.x

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion