CVE-2020-12393: mozilla firefox OS Command Injection
Vulnerability summary
CVE-2020-12393 is a high (CVSS 7.8) OS Command Injection vulnerability in mozilla firefox. EPSS estimates a 1.01% chance of exploitation in the next 30 days, higher than 62.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 26-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.01%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
0.00 pp
From 1.01% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla3 products
- firefox≥ unspecified, < 76 | < 76.0
- firefox_esr≥ unspecified, < 68.8 | < 68.8.0
- thunderbird≥ unspecified, < 68.8.0 | < 68.8.0
Ubuntu3 products
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
- mozjs68All versions (No fix recorded)
2 vendors · 6 products