CVE-2020-12415

Mozilla: AppCache manifest poisoning due to url encoded character processing

Loading…

Severity

Important

Red Hat Product Security

6.5

CVSS 3.1

Review impact separately from score.

Published · July 16, 2020

Updated · June 27, 2026

Description

When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a subdirectory. This could cause the appcache to be used to service requests for the top level directory. This vulnerability affects Firefox < 78.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')