CVE-2020-15653
Mozilla: Bypassing iframe sandbox when allowing popups
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
Un elemento del sandbox de iframe con el flag allow-popups podría ser omitida cuando se usan enlaces noopener. Esto podría haber conllevado a problemas de seguridad para los sitios web que dependen de configuraciones de sandbox que permitían ventanas emergentes y alojaban contenido arbitrario. Esta vulnerabilidad afecta a Firefox ESR versiones anteriores a 78.1, Firefox versiones anteriores a 79 y Thunderbird versiones anteriores a 78.1
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-07-10 CVE Reserved
- 2020-07-30 CVE Published
- 2024-07-17 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-276: Incorrect Default Permissions
CAPEC
References (7)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html | 2023-02-02 | |
https://usn.ubuntu.com/4443-1 | 2023-02-02 | |
https://www.mozilla.org/security/advisories/mfsa2020-30 | 2023-02-02 | |
https://www.mozilla.org/security/advisories/mfsa2020-32 | 2023-02-02 | |
https://www.mozilla.org/security/advisories/mfsa2020-33 | 2023-02-02 | |
https://access.redhat.com/security/cve/CVE-2020-15653 | 2020-09-30 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1861645 | 2020-09-30 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 79.0 Search vendor "Mozilla" for product "Firefox" and version " < 79.0" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 78.1 Search vendor "Mozilla" for product "Firefox Esr" and version " < 78.1" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 78.1 Search vendor "Mozilla" for product "Thunderbird" and version " < 78.1" | - |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | esm |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 20.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "20.04" | lts |
Affected
|