Auth bypass in Google Android
CVE-2018-12391
During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. *Note: this issue only affects Firefox for Android. Desktop versions of Firefox are unaffected.*. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.021 (80.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 81st percentile — 80.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.021 · newest: 0.021 · change: 0.000
Affected products
- Google Android
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Firefox Esr
- Mozilla Thunderbird — versions unspecified
Weakness classification (CWE)
References
- www.securityfocus.com/bid/105769 (VDB Entry, Third Party Advisory, vdb-entry)
- www.mozilla.org/security/advisories/mfsa2018-28/ (Vendor Advisory)
- www.mozilla.org/security/advisories/mfsa2018-26/ (Vendor Advisory)
- security.gentoo.org/glsa/201811-13 (vendor-advisory, Third Party Advisory)
- www.mozilla.org/security/advisories/mfsa2018-27/ (Vendor Advisory)
- www.securityfocus.com/bid/105718 (VDB Entry, Third Party Advisory, vdb-entry)
- bugzilla.mozilla.org/show_bug.cgi (Vendor Advisory, Permissions Required, Issue Tracking)
- www.securitytracker.com/id/1041944 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2018-12391?
- CVE-2018-12391 is a high-severity vulnerability in Google Android, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2019-02-28.
- How severe is CVE-2018-12391?
- High severity. CVSS v3 base score is 8.8 out of 10.