Vulnerability Details : CVE-2020-15653
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Products affected by CVE-2020-15653
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-15653
0.27%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 48 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-15653
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST |
References for CVE-2020-15653
-
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
[security-announce] openSUSE-SU-2020:1189-1: important: Security updateThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2020-32/
Security Vulnerabilities fixed in Firefox ESR 78.1 — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1521542
Access DeniedIssue Tracking;Permissions Required;Vendor Advisory
-
https://usn.ubuntu.com/4443-1/
USN-4443-1: Firefox vulnerabilities | Ubuntu security notices | UbuntuThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2020-33/
Security Vulnerabilities fixed in Thunderbird 78.1 — MozillaVendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2020-30/
Security Vulnerabilities fixed in Firefox 79 — MozillaVendor Advisory
Jump to