Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2020-12392: Firefox ESR and Thunderbird copy-as-cURL may expose local files
CVE-2020-12392 · published 6 years ago
Summary
The Copy as cURL command in the developer tools of Firefox ESR (versions before 68.8) and Thunderbird (versions before 68.8.0) does not correctly escape data that a website can set. When a user copies a request and runs the generated command, it could unintentionally reveal files from the user's own computer. Update to the latest versions of Firefox ESR and Thunderbird or avoid using the Copy as cURL feature until the fix is applied.
What to do
- Update debian firefox-esr to version 68.8.0esr-1.
- Update debian thunderbird to version 1:68.8.0-1.
- Update mozilla firefox to version 76.0 or later.
- Update mozilla firefox_esr to version 68.8.0 or later.
- Update mozilla thunderbird to version 68.8.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 68.8.0esr-1 Fix: upgrade to 68.8.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 68.8.0esr-1 Fix: upgrade to 68.8.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 68.8.0esr-1 Fix: upgrade to 68.8.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:68.8.0-1 Fix: upgrade to 1:68.8.0-1
|
| Debian:13 | debian | thunderbird |
< 1:68.8.0-1 Fix: upgrade to 1:68.8.0-1
|
| Debian:14 | debian | thunderbird |
< 1:68.8.0-1 Fix: upgrade to 1:68.8.0-1
|
| – | mozilla | firefox |
< 76.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 68.8.0 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 68.8.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
16.04 18.04 19.10 20.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
Original advisory text
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pa...
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.
References
- https://security-tracker.debian.org/tracker/CVE-2020-12392 Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 Issue Tracking Permissions Required
- https://security.gentoo.org/glsa/202005-03 Third Party Advisory
- https://security.gentoo.org/glsa/202005-04 Third Party Advisory
- https://usn.ubuntu.com/4373-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-16/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-17/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-18/ Vendor Advisory
Severity
5.5
Medium
Type
CWE-22Path Traversal
Timeline
Published26 May 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta