CVE-2020-12390

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 76

References

Timeline

Published
May 26, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-123917.5Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scriCVE-2020-123925.5The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the CVE-2020-123937.8The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the webCVE-2020-123943.3A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different oCVE-2020-123959.8Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed eCVE-2020-123969.8Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corCVE-2020-123974.3By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird dispCVE-2020-123987.5If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue witCVE-2020-123994.4NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerabCVE-2020-12408.8A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'CVE-2020-124004.7When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timCVE-2020-124014.7During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resultin
CVE-2020-12390: Critical severity, CVSS 9.8 | Vulnix