CVE-2020-12423: mozilla firefox Uncontrolled Search Path Element
Vulnerability summary
CVE-2020-12423 is a high (CVSS 7.8) Uncontrolled Search Path Element vulnerability in mozilla firefox. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 7Timeline
- 09-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have loaded the DLL, leading to arbitrary code execution. *Note: This issue only affects the Windows operating system; other operating systems are unaffected.* This vulnerability affects Firefox < 78.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla1 product
- firefox≥ unspecified, < 78 | < 78.0
1 vendor · 1 product
References
4 links- lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.htmlVendor AdvisoryX Refsource SUSEBroken Link
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.htmlVendor AdvisoryX Refsource SUSEBroken Link