Vulnerabilities > CVE-2020-6809 - Unspecified vulnerability in Mozilla Firefox
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
When a Web Extension had the all-urls permission and made a fetch request with a mode set to 'same-origin', it was possible for the Web Extension to read local files. This vulnerability affects Firefox < 74.
Vulnerable Configurations
Nessus
NASL family MacOS X Local Security Checks NASL id MACOS_FIREFOX_74_0.NASL description The version of Firefox installed on the remote macOS or Mac OS X host is prior to 74.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-08 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-05-06 modified 2020-03-11 plugin id 134404 published 2020-03-11 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134404 title Mozilla Firefox < 74.0 Multiple Vulnerabilities NASL family Windows NASL id MOZILLA_FIREFOX_74_0.NASL description The version of Firefox installed on the remote Windows host is prior to 74.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-08 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-05-06 modified 2020-03-11 plugin id 134405 published 2020-03-11 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134405 title Mozilla Firefox < 74.0 Multiple Vulnerabilities NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-4299-1.NASL description Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the URL or other browser chrome, obtain sensitive information, bypass Content Security Policy (CSP) protections, or execute arbitrary code. (CVE-2019-20503, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6808, CVE-2020-6810, CVE-2020-6812, CVE-2020-6813, CVE-2020-6814, CVE-2020-6815) It was discovered that Web Extensions with the all-url permission could access local files. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6809) It was discovered that the Devtools last seen 2020-05-08 modified 2020-03-12 plugin id 134442 published 2020-03-12 reporter Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/134442 title Ubuntu 16.04 LTS / 18.04 LTS / 19.10 : firefox vulnerabilities (USN-4299-1)