CVE-2020-15666

MediumCVSS 6.5/10Last modified Aug 19, 2026

Description

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156678.8When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading t CVE-2020-156684.3A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects CVE-2020-156698.8When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use CVE-2020-15674.2A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitra CVE-2020-156708.8Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption an CVE-2020-156713.1When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input CVE-2020-156738.8Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corr CVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. Thi CVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed a CVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This