CVE-2016-2820

MEDIUM

Firefox < 45.0.2 - Improper Access Control in Health Reports

Title source: llm

Description

The Firefox Health Reports (aka FHR or about:healthreport) feature in Mozilla Firefox before 46.0 does not properly restrict the origin of events, which makes it easier for remote attackers to modify sharing preferences by leveraging access to the remote-report IFRAME element.

References (9)

Core 9

Core References

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201701-15

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2936-1

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2936-3

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2016/mfsa2016-48.html

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=870870

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1035692

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2936-2

Scores

CVSS v3 4.3

EPSS 0.0042

EPSS Percentile 62.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE

CWE-284

Status published

Products (1)

mozilla/firefox < 45.0.2

Published Apr 30, 2016

Tracked Since Feb 18, 2026