CVE-2020-15663: mozilla firefox Uncontrolled Search Path Element
Vulnerability summary
CVE-2020-15663 is a high (CVSS 9.3) Uncontrolled Search Path Element vulnerability in mozilla firefox. EPSS estimates a 2.72% chance of exploitation in the next 30 days, higher than 85.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 12Timeline
- 01-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.72%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.72% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla3 products
- firefox≥ unspecified, < 80 | < 80.0 | ≥ 78.0, < 78.2
- firefox_esr≥ unspecified, < 68.12 | ≥ unspecified, < 78.2 | ≥ 68.0, < 68.12
- thunderbird≥ unspecified, < 78.2 | ≥ unspecified, < 68.12 | ≥ 68.0, < 68.12 | ≥ 78.0, < 78.2
1 vendor · 3 products
References
6 links- bugzilla.mozilla.org/show_bug.cgi?id=1643199X Refsource MISCIssue TrackingPermissions RequiredVendor Advisory