How severe is CVE-2020-15666?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.5 out of 10.

What type of vulnerability is CVE-2020-15666?

This is classified as CWE-209, which is a common weakness in software security.

CVE-2020-15666 - MEDIUM Severity | CVSS 6.5

Vulnerability Description

When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Related Vulnerabilities

CVE-2018-10624

MEDIUM

CVSS:6.5(Medium)

In Johnson Controls Metasys System Versions 8.0 and prior and BCPro (BCM) all versions prior to 3.0.2, this vulnerability results from improper error handling in HTTP-based communications with the ser...

CWE-2092018

CVE-2018-2379

MEDIUM

CVSS:6.5(Medium)

In SAP HANA Extended Application Services, 1.0, an unauthenticated user could test if a given username is valid by evaluating error messages of a specific endpoint.

CWE-2092018

CVE-2019-11252

MEDIUM

CVSS:6.5(Medium)

The Kubernetes kube-controller-manager in versions v1.0-v1.17 is vulnerable to a credential leakage via error messages in mount failure logs and events for AzureFile and CephFS volumes.

CWE-2092019

CVE-2019-13697

MEDIUM

CVSS:6.5(Medium)

Insufficient policy enforcement in performance APIs in Google Chrome prior to 77.0.3865.120 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

CWE-2092019

CVE-2019-14433

MEDIUM

CVSS:6.5(Medium)

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exceptio...

CWE-2092019

CVE-2019-3756

MEDIUM

CVSS:6.5(Medium)

RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI unde...

CWE-2092019