CVE-2024-1551Reliance on Cookies without Validation and Integrity Checking in Mozilla Firefox

Severity
6.1MEDIUMNVD
EPSS
0.3%
top 47.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 20
Latest updateMar 4

Description

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123, Firefox ESR < 115.8, and Thunderbird < 115.8.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages6 packages

CVEListV5mozilla/firefoxunspecified123
NVDmozilla/firefox< 115.8.0+1
CVEListV5mozilla/firefox_esrunspecified115.8
CVEListV5mozilla/thunderbirdunspecified115.8
NVDmozilla/thunderbird< 115.8.0

Also affects: Debian Linux 10.0

🔴Vulnerability Details

3
CVEList
CVE-2024-1551: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses2024-02-20
OSV
CVE-2024-1551: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses2024-02-20
GHSA
GHSA-cq85-4f5h-qqc4: Set-Cookie response headers were being incorrectly honored in multipart HTTP responses2024-02-20

📋Vendor Advisories

8
Ubuntu
Thunderbird vulnerabilities2024-03-04
Ubuntu
Firefox vulnerabilities2024-02-22
Red Hat
Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts2024-02-20
Microsoft
Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, the2024-02-13
Debian
CVE-2024-1551: firefox - Set-Cookie response headers were being incorrectly honored in multipart HTTP res...2024
CVE-2024-1551 — Mozilla Firefox vulnerability | cvebase