CVE-2020-15655 : What You Need to Know

A redirected HTTP request observed or modified through a web extension could bypass CORS checks, potentially disclosing cross-origin information in Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Understanding CVE-2020-15655

This CVE involves a vulnerability in Mozilla products that could allow bypassing of existing CORS checks through a web extension, leading to potential disclosure of cross-origin information.

What is CVE-2020-15655?

Affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1
Vulnerability allows bypassing CORS checks

The Impact of CVE-2020-15655

Potential disclosure of cross-origin information
Exploitation through redirected HTTP requests

Technical Details of CVE-2020-15655

This section provides in-depth technical details about the vulnerability.

Vulnerability Description

Redirected HTTP requests through web extensions
Bypassing existing CORS checks

Affected Systems and Versions

Firefox ESR < 78.1
Firefox < 79
Thunderbird < 78.1

Exploitation Mechanism

Use of Extension APIs to bypass Same-Origin Policy

Mitigation and Prevention

Learn how to mitigate and prevent the CVE-2020-15655 vulnerability.

Immediate Steps to Take

Update affected products to versions above the specified vulnerable versions
Disable or remove affected web extensions
Monitor for any unusual cross-origin information disclosures

Long-Term Security Practices

Regularly update browsers and email clients
Educate users on safe browsing practices
Implement strict Same-Origin Policy enforcement

Patching and Updates

Apply patches provided by Mozilla promptly
Stay informed about security advisories and updates from Mozilla