CVE-2020-26951

 

Published at: - 09-12-2020 02:15

Last modified: - 24-09-2022 03:03

Total changes: - 2

Description

A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://www.mozilla.org/security/advisories/mfsa2020-50/
• https://www.mozilla.org/security/advisories/mfsa2020-51/
• https://www.mozilla.org/security/advisories/mfsa2020-52/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1667113

 

Keywords

NVD

 

CVE-2020-26951

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures