Vulnerability Details CVE-2020-6830
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.009
EPSS Ranking 58.2%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
Products affected by CVE-2020-6830
-
cpe:2.3:a:mozilla:firefox_mobile:-
-
cpe:2.3:a:mozilla:firefox_mobile:14.0
-
cpe:2.3:a:mozilla:firefox_mobile:15.0
-
cpe:2.3:a:mozilla:firefox_mobile:15.1
-
cpe:2.3:a:mozilla:firefox_mobile:16.0
-
cpe:2.3:a:mozilla:firefox_mobile:16.1
-
cpe:2.3:a:mozilla:firefox_mobile:16.2
-
cpe:2.3:a:mozilla:firefox_mobile:17.0
-
cpe:2.3:a:mozilla:firefox_mobile:17.1
-
cpe:2.3:a:mozilla:firefox_mobile:17.2
-
cpe:2.3:a:mozilla:firefox_mobile:17.3
-
cpe:2.3:a:mozilla:firefox_mobile:18.0
-
cpe:2.3:a:mozilla:firefox_mobile:18.1
-
cpe:2.3:a:mozilla:firefox_mobile:18.2
-
cpe:2.3:a:mozilla:firefox_mobile:19.0
-
cpe:2.3:a:mozilla:firefox_mobile:19.1
-
cpe:2.3:a:mozilla:firefox_mobile:20.0
-
cpe:2.3:a:mozilla:firefox_mobile:20.1
-
cpe:2.3:a:mozilla:firefox_mobile:20.2
-
cpe:2.3:a:mozilla:firefox_mobile:21.0
-
cpe:2.3:a:mozilla:firefox_mobile:22.0
-
cpe:2.3:a:mozilla:firefox_mobile:23.0
-
cpe:2.3:a:mozilla:firefox_mobile:24.0
-
cpe:2.3:a:mozilla:firefox_mobile:24.1