What is the CVSS score of CVE-2014-1520?

CVE-2014-1520 has a CVSS 2.0 base score of 6.9 (Medium). CVSS vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2014-1520?

Yes, a public proof-of-concept exploit is available for CVE-2014-1520. Prioritise patching immediately. EPSS: 0.0%.

Firefox CVE-2014-1520

MEDIUM

Improper Privilege Management (CWE-269)

2014-04-30 security@mozilla.org

Mozilla Privilege Escalation Microsoft Firefox Fedora

6.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

AV:L/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Apr 30, 2014 - 10:49 cve.org

MEDIUM 6.9

DescriptionCVE.org

maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process.

AnalysisAI

maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan. Rated medium severity (CVSS 6.9). Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process. Affected products include: Mozilla Firefox, Fedoraproject Fedora. Version information: before 29.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.