Vulnerability Description
A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 28.
CVSS Score
4.3
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 28.0 |
| Apple | Iphone Os | - |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1649160Issue TrackingVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-34/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1649160Issue TrackingVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-34/Vendor Advisory
FAQ
What is CVE-2020-15651?
CVE-2020-15651 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A unicode RTL order character in the downloaded file name can be used to change the file's name during the download UI flow to change the file extension. This vulnerability affects Firefox for iOS < 2...
How severe is CVE-2020-15651?
CVE-2020-15651 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15651?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Apple Iphone Os.