Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-15663

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Published

2020-10-01T19:15:12.970

Last Modified

2024-11-21T05:05:58.227

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

8.6

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-427
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla firefox < 80.0 Yes
Application mozilla firefox < 78.2 Yes
Application mozilla firefox_esr < 68.12 Yes
Application mozilla thunderbird < 68.12 Yes
Application mozilla thunderbird < 78.2 Yes
References