Mozilla Firefox/Firefox ESR/Thunderbird DevTools information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Mozilla Firefox, Firefox ESR and Thunderbird. This affects an unknown part of the component DevTools. The manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2020-12392. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox, Firefox ESR and Thunderbird (Web Browser) (affected version unknown) and classified as problematic. This issue affects an unknown functionality of the component DevTools. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

The weakness was disclosed 05/26/2020. The identification of this vulnerability is CVE-2020-12392 since 04/28/2020. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading eliminates this vulnerability.

The entries VDB-155600 and VDB-155598 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox
• Firefox ESR
• Thunderbird

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion