CVE-2016-5284

Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.

• CVE ID
• CVE-2016-5284

• Assigner
• security@mozilla.org

• Vulnerability Status
• Modified

• Published Version
• 2016-09-22T22:59:18

• Last Modified Date
• 2018-10-30T16:27:02

• Version
• 2.0

• Vector String
• AV:N/AC:M/Au:N/C:P/I:N/A:N

• Access Vector
• NETWORK

• Access Compatibility
• MEDIUM

• Authentication
• NONE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• NONE

• Availability Impact
• NONE

• Base Score
• 4.3

• Severity
• MEDIUM

• Exploitability Score
• 8.6

• Impact Score
• 2.9

• Version
• 3.0

• Vector String
• CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

• Attack Vector
• NETWORK

• Attack Compatibility
• LOW

• Privileges Required
• NONE

• User Interaction
• REQUIRED

• Scope
• CHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• NONE

• Base Score
• 7.4

• Base Severity
• HIGH

• Exploitability Score
• 2.8

• Impact Score
• 4