Lucene search

K
ubuntucveUbuntu.comUB:CVE-2020-6811
HistoryMar 11, 2020 - 12:00 a.m.

CVE-2020-6811

2020-03-1100:00:00
ubuntu.com
ubuntu.com
23
devtools
curl
command injection
thunderbird
firefox
vulnerability
arbitrary command execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.011

Percentile

84.3%

The ‘Copy as cURL’ feature of Devtools’ network tab did not properly escape
the HTTP method of a request, which can be controlled by the website. If a
user used the ‘Copy as Curl’ feature and pasted the command into a
terminal, it could have resulted in command injection and arbitrary command
execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74,
Firefox < ESR68.6, and Firefox ESR < 68.6.

Notes

Author Note
tyhicks mozjs contains a copy of the SpiderMonkey JavaScript engine
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchfirefox< 74.0+build3-0ubuntu0.18.04.1UNKNOWN
ubuntu19.10noarchfirefox< 74.0+build3-0ubuntu0.19.10.1UNKNOWN
ubuntu20.04noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu20.10noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu21.04noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu21.10noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu22.04noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu22.10noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu23.04noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
ubuntu23.10noarchfirefox< 74.0+build3-0ubuntu1UNKNOWN
Rows per page:
1-10 of 271

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.011

Percentile

84.3%