CVE-2020-15677

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.mozilla.org/security/advisories/mfsa2020-42/", "name": "https://www.mozilla.org/security/advisories/mfsa2020-42/", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2020-43/", "name": "https://www.mozilla.org/security/advisories/mfsa2020-43/", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1641487", "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1641487", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2020-44/", "name": "https://www.mozilla.org/security/advisories/mfsa2020-44/", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://www.debian.org/security/2020/dsa-4770", "name": "DSA-4770", "tags": ["Third Party Advisory"], "refsource": "DEBIAN"}, {"url": "https://lists.debian.org/debian-lts-announce/2020/10/msg00020.html", "name": "[debian-lts-announce] 20201016 [SECURITY] [DLA 2408-1] thunderbird security update", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://security.gentoo.org/glsa/202010-02", "name": "GLSA-202010-02", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html", "name": "openSUSE-SU-2020:1785", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "refsource": "SUSE"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html", "name": "openSUSE-SU-2020:1780", "tags": ["Broken Link", "Mailing List", "Third Party Advisory"], "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-601"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-15677", "ASSIGNER": "security@mozilla.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}}, "publishedDate": "2020-10-01T19:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "78.3"}, {"cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "78.3"}, {"cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "81.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-11-16T15:15Z"}