CVE-2020-6813

2020-03-2521:11:41

mozilla

www.cve.org

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.4%

JSON

When protecting CSS blocks with the nonce feature of Content Security Policy, the @import statement in the CSS block could allow an attacker to inject arbitrary styles, bypassing the intent of the Content Security Policy. This vulnerability affects Firefox < 74.

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "74",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]