// For flags

CVE-2014-1515

Firefox for Android Information Leak

Time Line
Published
2024-03-19
Updated
2024-03-19
Firt exploit
2024-03-19
Overview
Descriptions (3)
NVD, NVD, PS
CWE (1)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC (-)
Risk
CVSS Score
5.5 Medium
SSVC
-
KEV
-
EPSS
0.1%
Affected Products (-)
Vendors (2)
mozilla, google
Products (2)
firefox, android
Versions (1)
<= 28.0
Intel Resources (1)
Advisories (1)
PacketStorm
Exploits (-)
-
Plugins (-)
-
References (3)
General (2)
neohapsis, mozilla
Exploits & POcs (-)
Patches (-)
Advisories (1)
mozilla
Summary
Descriptions

Mozilla Firefox before 28.0.1 on Android processes a file: URL by copying a local file onto the SD card, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application.

Mozilla Firefox anterior a 28.0.1 en Android procesa un archivo: URL copiando un archivo local a la tarjeta SD, lo que permite a atacantes obtener información sensible del directorio de perfil de Firefox a través de una aplicación manipulada.

A series of vulnerabilities have been discovered in Firefox for Android that allows a malicious application to successfully derandomize the Firefox profile directory name in a practical amount of time and then leak sensitive data (such as cookies and cached information) which reside in that directory, breaking Android's sandbox.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Local
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2014-01-16 CVE Reserved
  • 2014-03-25 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Threat Intelligence Resources (1)
Security Advisory details:

Select an advisory to view details here.

Select an exploit to view details here.

Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mozilla
Search vendor "Mozilla"
 Firefox
Search vendor "Mozilla" for product "Firefox"
 <= 28.0
Search vendor "Mozilla" for product "Firefox" and version " <= 28.0"
-
Affected
in Google
Search vendor "Google"
 Android
Search vendor "Google" for product "Android"
*-
Safe