CVE-2020-12393
CVE-2020-12393
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS 7.8 · High · EPSS 1.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
firefox esr
- Versions
- ≥ unspecified, < 68.8: Affected (custom)
Update to 68.8
firefox
- Versions
- ≥ unspecified, < 76: Affected (custom)
Update to 76
thunderbird
- Versions
- ≥ unspecified, < 68.8.0: Affected (custom)
Update to 68.8.0
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs68 Ubuntu:20.04:LTS
- Versions
- 68.5.0-1~fakesync
- 68.5.0-2~fakesync
- 68.6.0-1
- 68.6.0-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:20.04:LTS
- Versions
- 52.9.1-1build1
- 52.9.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published