Auth bypass in Google Android
CVE-2018-12391
During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
Vulnerability class: Broken Access Control
EPSS: 0.021 (79.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Google Android
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Firefox_esr
- Mozilla Thunderbird — versions unspecified
Weakness classification (CWE)
References
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@mozilla.org (Vendor Advisory, Permissions Required, x_refsource_CONFIRM, Issue Tracking)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2018-12391?
- CVE-2018-12391 is a high-severity vulnerability in Google Android, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2019-02-28.
- How severe is CVE-2018-12391?
- High severity. CVSS v3 base score is 8.8 out of 10.