Home

CVE-2020-26976

Description

When a HTTPS pages was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing. This vulnerability affects Firefox < 84.

Risk Information

Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
1.973

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities fixed in Mozilla Firefox (84.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (x64) (84.0)Windows
Multiple Vulnerabilities are affected in Mozilla Firefox (x64) 83.99Windows
Multiple Vulnerabilities are affected in Mozilla_Firefox 83.99Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (84.0)Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (84.0.1)Mac
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (84.0.2)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (78.7.0)Mac
Multiple vulnerabilities are fixed in Mozilla Thunderbird For Mac (78.7.1)Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 83.0Mac
Vulnerabilities CVE-2020-26976,CVE-2021-23953,CVE-2021-23954,CVE-2021-23960,CVE-2021-23964 are fixed in Mozilla Firefox For Mac 78.7Mac
Mozilla Open Source web browser (USN-4671-1) firefox_84.0+build3-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4671-1) firefox_84.0+build3-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4671-1) firefox_84.0+build3-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4671-1) firefox_84.0+build3-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4671-1) firefox_84.0+build3-0ubuntu0.20.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4671-1) firefox_84.0+build3-0ubuntu0.20.10.1_amd64.debLinux
firefox-esr security update(DSA-4840-1) firefox-esr_78.7.0esr-1~deb10u1_i386.debLinux
firefox-esr security update(DSA-4840-1) firefox-esr_78.7.0esr-1~deb10u1_amd64.debLinux
(RHSA-2021:0288) firefox security update firefox-78.7.0-2.el8_3.x86_64.rpmLinux
(RHSA-2021:0288) firefox security update firefox-debugsource-78.7.0-2.el8_3.x86_64.rpmLinux
(RHSA-2021:0290) firefox security update firefox-78.7.0-2.el7_9.i686.rpmLinux
(RHSA-2021:0290) firefox security update firefox-78.7.0-2.el7_9.x86_64.rpmLinux
SUSE-SU-2021:0241-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-78.7.0-112.45.1.x86_64.rpmLinux
SUSE-SU-2021:0241-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debuginfo-78.7.0-112.45.1.x86_64.rpmLinux
SUSE-SU-2021:0241-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debugsource-78.7.0-112.45.1.x86_64.rpmLinux
SUSE-SU-2021:0241-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-devel-78.7.0-112.45.1.x86_64.rpmLinux
SUSE-SU-2021:0241-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-translations-common-78.7.0-112.45.1.x86_64.rpmLinux
thunderbird security update(DSA-4842-1) thunderbird_78.7.0-1~deb10u1_i386.debLinux
thunderbird security update(DSA-4842-1) thunderbird_78.7.0-1~deb10u1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4736-1) thunderbird_78.7.1+build1-0ubuntu0.20.10.4_amd64.debLinux
(RHSA-2021:0297) thunderbird security update thunderbird-78.7.0-1.el7_9.x86_64.rpmLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-317521Mozilla Firefox (84.0)
PATCH-317522Mozilla Firefox (x64) (84.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234