CVE-2020-6823 Missing authorization in Firefox
A malicious extension could obtain authentication codes via a controlled redirect, allowing attackers to take over user accounts on service providers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-6823?
CVE-2020-6823 is a critical missing authorization vulnerability in Mozilla Firefox, published on 24 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malicious extension could have called <code>browser.identity.launchWebAuthFlow</code>, controlling the redirect_uri, and through the Promise returned, obtain the Auth code and gain access to the user's account at the service provider. This vulnerability affects Firefox < 75.
Weakness: CWE-862
Which versions are affected by CVE-2020-6823?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2020-6823?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-6823 being exploited?
There is no known exploitation of CVE-2020-6823 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-cm6f-xjjv-f446, UBUNTU-CVE-2020-6823.