CVE-2014-8639 — Argument Injection in Mozilla Firefox

CWE-88 — Argument Injection8 documents7 sources
Severity
6.8MEDIUMNVD
EPSS
1.8%
top 17.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla ThunderbirdMozilla Seamonkey+1 more
Timeline
PublishedJan 14
Latest updateMay 17

Description

Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages6 packages

▶Ubuntumozilla/firefox< 35.0+build3-0ubuntu0.14.04.2
▶NVDmozilla/firefox34.0.5+4
▶Ubuntumozilla/thunderbird< 1:31.4.0+build1-0ubuntu0.14.04.1

🔴Vulnerability Details

3
GHSA
GHSA-cfgr-xpqw-rcxf: Mozilla Firefox before 35↗2022-05-17
▶
CVEList
CVE-2014-8639: Mozilla Firefox before 35↗2015-01-14
▶
OSV
CVE-2014-8639: Mozilla Firefox before 35↗2015-01-14
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2015-01-19
▶
Ubuntu
Firefox vulnerabilities↗2015-01-14
▶
Red Hat
Mozilla: Cookie injection through Proxy Authenticate responses (MFSA 2015-04)↗2015-01-13
▶

💬Community

1
Bugzilla
CVE-2014-8639 Mozilla: Cookie injection through Proxy Authenticate responses (MFSA 2015-04)↗2015-01-12
▶
CVE-2014-8639 — Argument Injection in Mozilla Firefox | cvebase