CVE-2024-1555 — Authentication Bypass by Spoofing in Mozilla Firefox

CWE-290 — Authentication Bypass by Spoofing11 documents8 sources
Severity
8.3HIGHNVD
OSV7.5
EPSS
0.1%
top 75.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedFeb 20
Latest updateMay 19

Description

When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox < 123.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:LExploitability: 2.8 | Impact: 5.5

Affected Packages3 packages

▶CVEListV5mozilla/firefoxunspecified — 123
▶NVDmozilla/firefox< 123.0
▶Ubuntumozilla/firefox< 123.0+build3-0ubuntu0.20.04.1+1

🔴Vulnerability Details

5
OSV
firefox regressions↗2024-03-06
▶
OSV
firefox vulnerabilities↗2024-02-22
▶
GHSA
GHSA-j6qq-7xp7-c5p5: When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected↗2024-02-20
▶
OSV
CVE-2024-1555: When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected↗2024-02-20
▶
CVEList
CVE-2024-1555: When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected↗2024-02-20
▶

📋Vendor Advisories

5
Red Hat
kernel: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()↗2024-05-19
▶
Ubuntu
Firefox regressions↗2024-03-06
▶
Ubuntu
Firefox vulnerabilities↗2024-02-22
▶
Debian
CVE-2024-1555: firefox - When opening a website using the `firefox://` protocol handler, SameSite cookies...↗2024
▶
Mozilla
Mozilla Foundation Security Advisory 2024-05: CVE-2024-1555↗
▶
CVE-2024-1555 — Authentication Bypass by Spoofing | cvebase