CVE-2020-12413 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
mozilla	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 37%

Vendor	Product	Version
mozilla	firefox	𝑥 < 78.0
mozilla	firefox_esr	𝑥 < 68.10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

nss

bullseye	2:3.61-1+deb11u3 fixed
buster	no-dsa
stretch	no-dsa
bullseye (security)	2:3.61-1+deb11u4 fixed
bookworm	2:3.87.1-1 fixed
sid	2:3.105-2 fixed
trixie	2:3.105-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

nss

jammy	not-affected
impish	not-affected
hirsute	ignored
groovy	ignored
focal	not-affected
bionic	not-affected
xenial	not-affected
trusty	not-affected

Common Weakness Enumeration

CWE-203 - Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413

https://raccoon-attack.com/

https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2020-12413

https://raccoon-attack.com/