Search for vulnerabilities
Vulnerability details: VCID-5aa1-zhmp-t7gp
Vulnerability ID VCID-5aa1-zhmp-t7gp
Aliases CVE-2020-15685
Summary During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-15685.json
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
epss 0.0042 https://api.first.org/data/v1/epss?cve=CVE-2020-15685
cvssv3.1 8.8 https://bugzilla.mozilla.org/show_bug.cgi?id=1622640
ssvc Track* https://bugzilla.mozilla.org/show_bug.cgi?id=1622640
cvssv3.1 6.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2020-15685
archlinux High https://security.archlinux.org/AVG-1496
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2021-05
cvssv3.1 8.8 https://www.mozilla.org/security/advisories/mfsa2021-05/
ssvc Track* https://www.mozilla.org/security/advisories/mfsa2021-05/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-15685.json
https://api.first.org/data/v1/epss?cve=CVE-2020-15685
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15685
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16044
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26976
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23953
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23954
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23960
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23964
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1921543 https://bugzilla.redhat.com/show_bug.cgi?id=1921543
ASA-202102-2 https://security.archlinux.org/ASA-202102-2
AVG-1496 https://security.archlinux.org/AVG-1496
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2020-15685 https://nvd.nist.gov/vuln/detail/CVE-2020-15685
mfsa2021-05 https://www.mozilla.org/en-US/security/advisories/mfsa2021-05
mfsa2021-05 https://www.mozilla.org/security/advisories/mfsa2021-05/
RHSA-2021:0297 https://access.redhat.com/errata/RHSA-2021:0297
RHSA-2021:0298 https://access.redhat.com/errata/RHSA-2021:0298
RHSA-2021:0299 https://access.redhat.com/errata/RHSA-2021:0299
RHSA-2021:0397 https://access.redhat.com/errata/RHSA-2021:0397
show_bug.cgi?id=1622640 https://bugzilla.mozilla.org/show_bug.cgi?id=1622640
USN-4736-1 https://usn.ubuntu.com/4736-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-15685.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1622640
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-16T14:40:20Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1622640
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2020-15685
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.mozilla.org/security/advisories/mfsa2021-05/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-04-16T14:40:20Z/ Found at https://www.mozilla.org/security/advisories/mfsa2021-05/
Exploit Prediction Scoring System (EPSS)
Percentile 0.61076
EPSS Score 0.0042
Published At Aug. 7, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:09:50.707941+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2021/mfsa2021-05.yml 37.0.0