Unscored severity · published Aug 8, 2015
CVE-2015-5961
The COPPA error page in the Accounts setup dialog in Mozilla Firefox OS before 2.2 embeds content from an external web server URL into the System process, which allows…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The COPPA error page in the Accounts setup dialog in Mozilla Firefox OS before 2.2 embeds content from an external web server URL into the System process, which allows man-in-the-middle attackers to bypass intended access restrictions by spoofing that server.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Firefox OS · Mozilla
through 2.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5961
www.mozilla.org
http://www.mozilla.org/security/announce/2015/mfsa2015-75.html
www.securityfocus.com
http://www.securityfocus.com/bid/76255
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1123433
More from Firefox OS
8.8
CVE-2015-4495
Mozilla Firefox Security Feature Bypass Vulnerability
6.4
CVE-2015-8511
Race condition in the lockscreen feature in Mozilla Firefox OS before 2.5 allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors
6.1
CVE-2015-8510
Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers…
4.6
CVE-2015-8512
The lockscreen feature in Mozilla Firefox OS before 2.5 does not properly restrict failed authentication attempts, which makes it easier for physically proximate attackers to…
3.7
CVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows…