CVE-2014-1566

2014-09-0310:55:06

CWE-264

mozilla

web.nvd.nist.gov

mozilla

firefox

android

cve

2014

1566

vulnerability

sd card

file urls

sensitive information

profile directory

incomplete fix

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

8.4

Confidence

High

EPSS

0.001

Percentile

48.4%

JSON

Mozilla Firefox before 31.1 on Android does not properly restrict copying of local files onto the SD card during processing of file: URLs, which allows attackers to obtain sensitive information from the Firefox profile directory via a crafted application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1515.

Affected configurations

Nvd

Node

mozillafirefoxRange≤31.0

mozillafirefoxMatch30.0

AND

googleandroid

VendorProductVersionCPE
mozillafirefox*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozillafirefox30.0cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*
googleandroid*cpe:2.3:o:google:android:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	firefox	*	cpe:2.3:a:mozilla:firefox::::::::
mozilla	firefox	30.0	cpe:2.3:a:mozilla:firefox:30.0:::::::*
google	android	*	cpe:2.3:o:google:android::::::::