Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2016-2820

Date: April 30, 2016

The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element.

Severity Score

Related Resources (12)

https://security.gentoo.org/glsa/201701-15
http://www.ubuntu.com/usn/USN-2936-3
https://bugzilla.mozilla.org/show_bug.cgi?id=870870
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html
http://www.mozilla.org/security/announce/2016/mfsa2016-48.html
http://www.securitytracker.com/id/1035692
http://www.ubuntu.com/usn/USN-2936-1
https://nvd.nist.gov/vuln/detail/CVE-2016-2820
http://www.ubuntu.com/usn/USN-2936-2
https://people.canonical.com/~ubuntu-security/cve/CVE-2016-2820
http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html
https://www.mend.io/vulnerability-database/CVE-2016-2820

Severity Score

Weakness Type (CWE)

Improper Access Control

CWE-284

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us