Code injection

2015-02-2511:59:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

56.2%

JSON

The WebRTC subsystem in Mozilla Firefox before 36.0 recognizes turns: and stuns: URIs but accesses the TURN or STUN server without using TLS, which makes it easier for man-in-the-middle attackers to discover credentials by spoofing a server and completing a brute-force attack within a short time window.

CPENameOperatorVersion
ubuntu_linuxeq12.04
ubuntu_linuxeq14.10
ubuntu_linuxeq14.04
firefoxeq13.0.1
firefoxeq14.0.1
firefoxeq18.0
firefoxeq0.1
firefoxeq10.0.7
firefoxeq4.0 beta6
firefoxeq4.0 beta1

Name	Operator	Version
ubuntu_linux	eq	12.04
ubuntu_linux	eq	14.10
ubuntu_linux	eq	14.04
firefox	eq	13.0.1
firefox	eq	14.0.1
firefox	eq	18.0
firefox	eq	0.1
firefox	eq	10.0.7
firefox	eq	4.0 beta6
firefox	eq	4.0 beta1