CVE-2020-12412

firefox: address bar spoof using history navigation and blocked ports

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 3.1

Review impact separately from score.

Published · July 9, 2020

Updated · January 14, 2026

Description

By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// scheme, a blocked port number such as '1', and without a lock icon) while controlling the page contents. This vulnerability affects Firefox < 70.

Statement

This vulnerability was reported in Firefox 70 mainline; ESR versions were not affected.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')