PT-2017-3677 · Mozilla+2 · Firefox+2
Inko
·
Published
2017-11-28
·
Updated
2024-12-12
·
CVE-2018-5114
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions:
Firefox versions prior to 58
Description:
The issue is related to errors in the implementation of cookie storage in Mozilla Firefox. It allows a remote attacker to access HttpOnly cookies using a crafted HTTP request. When an existing cookie is changed to be "HttpOnly" while a document is open, the original value remains accessible through script until that document is closed. However, network requests correctly use the changed HttpOnly cookie.
Recommendations:
For versions prior to 58, update to version 58 or later to resolve the issue. As a temporary workaround, consider closing all documents after changing a cookie to "HttpOnly" to prevent script access to the original value. Restrict access to sensitive information stored in cookies to minimize the risk of exploitation.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Ubuntu