CVE-2020-6794

If a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords is still accessible. This is because the older stored password file was not deleted when the data was copied to a new format starting in Thunderbird 60. The new master password is added only on the new file. This could allow the exposure of stored password data outside of user expectations. This vulnerability affects Thunderbird < 68.5.

• CWE-312
• CWE-459
• CWE-522

• https://bugzilla.mozilla.org/show_bug.cgi?id=1606619Exploit, Issue Tracking, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202003-10Third Party Advisory
• https://usn.ubuntu.com/4328-1/Third Party Advisory
• https://usn.ubuntu.com/4335-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-07/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1606619Exploit, Issue Tracking, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202003-10Third Party Advisory
• https://usn.ubuntu.com/4328-1/Third Party Advisory
• https://usn.ubuntu.com/4335-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-07/Vendor Advisory

Published

Mar 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6787Loading a DLL through an Uncontrolled Search Path Element in…7.8
• CVE-2020-6788Loading a DLL through an Uncontrolled Search Path Element in…7.8
• CVE-2020-6789Loading a DLL through an Uncontrolled Search Path Element in…7.8
• CVE-2020-6790Calling an executable through an Uncontrolled Search Path El…7.8
• CVE-2020-6792When deriving an identifier for an email message, uninitiali…4.3
• CVE-2020-6793When processing an email message with an ill-formed envelope…6.5
• CVE-2020-6795When processing a message that contains multiple S/MIME sign…6.5
• CVE-2020-6796A content process could have modified shared memory relating…8.8
• CVE-2020-6797By downloading a file with the .fileloc extension, a semi-pr…4.3
• CVE-2020-6798If a template tag was used in a select tag, the parser could…6.1
• CVE-2020-6799Command line arguments could have been injected during Firef…8.8
• CVE-2020-6800Mozilla developers and community members reported memory saf…8.8