VULNERABILITY INTELLIGENCE

CVE-2020-6808

CVSS score6.5 MEDIUM

EPSS probability1.10%

CISA KEVNot currently listed

Published2020-03-25

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented. Previously, this document's URL (as reported by the document.location property, for example) was the originating javascript: URL which could lead to spoofing attacks; it is now correctly the URL of the originating document. This vulnerability affects Firefox < 74.

Weakness classification

nvd@nist.gov: CWE-290

Primary references

security@mozilla.org — Issue Tracking, Permissions Required
security@mozilla.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Permissions Required
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory