CVE-2008-7293
published 2011-08-09CVE-2008-7293: Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite…
PriorityP425medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EPSS
1.68%
74.6th percentile
Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Affected
107 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 4.0 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: unable to restrict modifications to cookies in HTTPS sessions due to loack of HSTS support
vendor_redhat·2008-11-24·CVSS 5.8
CVE-2008-7293 [MEDIUM] firefox: unable to restrict modifications to cookies in HTTPS sessions due to loack of HSTS support
firefox: unable to restrict modifications to cookies in HTTPS sessions due to loack of HSTS support
Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Statement: This issue was addressed in Red Hat Enterprise Linux 5 and 6 by rebasing Firefox to 10.0.0 ESR.
Package: firefox (Red Hat Enterprise Linux 4) - Will not fix
Package: firefox (Red Hat Enterprise Linux 5) - Affected
Package: firefox (Red Hat Enterprise Linux 6) - Affected
GHSA
GHSA-87wr-93m4-5rjf: Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to
ghsa_unreviewed·2022-05-17
CVE-2008-7293 [MEDIUM] GHSA-87wr-93m4-5rjf: Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to
Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
No detection rules found.
No public exploits indexed.
http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookieshttp://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-force-https/http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.htmlhttp://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.htmlhttp://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=660053http://code.google.com/p/browsersec/wiki/Part2#Same-origin_policy_for_cookieshttp://hacks.mozilla.org/2010/08/firefox-4-http-strict-transport-security-force-https/http://michael-coates.blogspot.com/2010/01/cookie-forcing-trust-your-cookies-no.htmlhttp://scarybeastsecurity.blogspot.com/2008/11/cookie-forcing.htmlhttp://scarybeastsecurity.blogspot.com/2011/02/some-less-obvious-benefits-of-hsts.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=660053
2011-08-09
Published