Vulnerability Description
An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as that user. This issue is limited to cases where attacker and victim are sharing the same source IP and could allow the ability to view session states and disconnect VPN sessions. This vulnerability affects Mozilla VPN iOS 1.0.7 < (929), Mozilla VPN Windows < 1.2.2, and Mozilla VPN Android 1.1.0 < (1360).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Vpn | < 1.0.7_\(929\) |
Related Weaknesses (CWE)
References
- https://github.com/mozilla-mobile/guardian-vpn-android/commit/981c840276ef3aee98PatchThird Party Advisory
- https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39acPatchThird Party Advisory
- https://github.com/mozilla-services/guardian-vpn-windows/commit/ac6f562973a83f67PatchThird Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-48/Vendor Advisory
- https://github.com/mozilla-mobile/guardian-vpn-android/commit/981c840276ef3aee98PatchThird Party Advisory
- https://github.com/mozilla-mobile/guardian-vpn-ios/commit/4309f5c9bd2c15cdfd39acPatchThird Party Advisory
- https://github.com/mozilla-services/guardian-vpn-windows/commit/ac6f562973a83f67PatchThird Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-48/Vendor Advisory
FAQ
What is CVE-2020-15679?
CVE-2020-15679 is a vulnerability with a CVSS score of 7.6 (HIGH). An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user to login via that URL, and obtain authenticated access as t...
How severe is CVE-2020-15679?
CVE-2020-15679 has been rated HIGH with a CVSS base score of 7.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15679?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Vpn.