CVE-2020-15651

4.3MEDIUM

Key Information:

Vendor
Mozilla
Status
Firefox For iOS
Vendor
CVE Published:
10 August 2020

Summary

A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.

Affected Version(s)

Firefox for iOS < 28

References

https://www.mozilla.org/security/advisories/mfsa2020-34/
x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1649160
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.