CVE-2020-15666: Medium severity firefox vulnerability
When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2020-15666.
What is the severity of CVE-2020-15666?
The severity of CVE-2020-15666 is medium with a CVSS score of 6.5.
Which software products are affected by CVE-2020-15666?
Mozilla Firefox version 80 and Google Android are affected by CVE-2020-15666.
How does CVE-2020-15666 impact users?
CVE-2020-15666 can lead to the disclosure of exact status codes, which can enable attackers to infer login status.
How can I fix CVE-2020-15666?
Update Mozilla Firefox to version 80 or later to fix CVE-2020-15666.