CVE-2020-15677

By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

• CWE-601

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.htmlBroken Link, Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.htmlBroken Link, Mailing List, Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1641487Issue Tracking, Permissions Required, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00020.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202010-02Third Party Advisory
• https://www.debian.org/security/2020/dsa-4770Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-42/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-43/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-44/Release Notes, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.htmlBroken Link, Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.htmlBroken Link, Mailing List, Third Party Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1641487Issue Tracking, Permissions Required, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00020.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202010-02Third Party Advisory
• https://www.debian.org/security/2020/dsa-4770Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-42/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-43/Release Notes, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-44/Release Notes, Vendor Advisory

Published

Oct 1, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15670Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2020-15671When typing in a password under certain conditions, a race m…3.1
• CVE-2020-15673Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2020-15674Mozilla developers reported memory safety bugs present in Fi…8.8
• CVE-2020-15675When processing surfaces, the lifetime may outlive a persist…8.8
• CVE-2020-15676Firefox sometimes ran the onload handler for SVG elements th…6.1
• CVE-2020-15678When recursing through graphical layers while scrolling, an …8.8
• CVE-2020-15679An OAuth session fixation vulnerability existed in the VPN l…7.6
• CVE-2020-1568A remote code execution vulnerability exists when Microsoft …7.5
• CVE-2020-15680If a valid external protocol handler was referenced in an im…5.3
• CVE-2020-15681When multiple WASM threads had a reference to a module, and …7.5
• CVE-2020-15682When a link to an external protocol was clicked, a prompt wa…6.5