CVE-2020-15679

Severity Score

7.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360).

Existía una vulnerabilidad de reparación de sesión de OAuth en el flujo de inicio de sesión de VPN, donde un atacante podía crear una URL de inicio de sesión personalizada, convencer a un usuario de VPN para que iniciara sesión a través de esa URL y obtener acceso autenticado como ese usuario. Este problema se limita a los casos en los que el atacante y la víctima comparten la misma IP de origen y podría permitir la posibilidad de ver los estados de las sesiones y desconectar las sesiones de VPN. Esta vulnerabilidad afecta a Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2 y Mozilla VPN Android 1.1.0 < (1360).

*Credits: N/A

CVSS Scores

NISTv3.1 7.6

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-07-10 CVE Reserved
2022-12-22 CVE Published
2024-08-04 CVE Updated
2024-08-12 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-384: Session Fixation

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://github.com/mozilla-mobile/guardian-vpn-android/commit/981c840276ef3aee98cf5d42993d484ee99b28d9	2022-12-29
https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39ac173665fad3f2598b54	2022-12-29
https://github.com/mozilla-services/guardian-vpn-windows/commit/ac6f562973a83f6758cd7ab7aa313e863047d41b	2022-12-29

URL	Date	SRC
https://www.mozilla.org/security/advisories/mfsa2020-48	2022-12-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Vpn Search vendor "Mozilla" for product "Vpn"				< 1.0.7_\(929\) Search vendor "Mozilla" for product "Vpn" and version " < 1.0.7_\(929\)"		iphone_os		Affected
Mozilla Search vendor "Mozilla"		Vpn Search vendor "Mozilla" for product "Vpn"				< 1.2.2 Search vendor "Mozilla" for product "Vpn" and version " < 1.2.2"		windows		Affected
Mozilla Search vendor "Mozilla"		Vpn Search vendor "Mozilla" for product "Vpn"				>= 1.0.7 < 1.0.7_\(929\) Search vendor "Mozilla" for product "Vpn" and version " >= 1.0.7 < 1.0.7_\(929\)"		ipados		Affected
Mozilla Search vendor "Mozilla"		Vpn Search vendor "Mozilla" for product "Vpn"				>= 1.1.0 < 1.1.0_\(1360\) Search vendor "Mozilla" for product "Vpn" and version " >= 1.1.0 < 1.1.0_\(1360\)"		android		Affected