PT-2023-6529 · Mozilla+5 · Firefox+5

Annevk

·

Published

2023-10-24

·

Updated

2025-03-14

·

CVE-2023-5722

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 119
Description The issue is related to insufficient protection of service data when processing the Vary header response for matching request headers. An attacker can exploit this by sending iterative requests to learn the size of an opaque response and the contents of a server-supplied Vary header, potentially allowing unauthorized access to protected information.
Recommendations For versions prior to 119, update to Firefox version 119 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

Information Disclosure

Side Channel Attack

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-942CWE-200CWE-203

Related Identifiers

ALT-PU-2023-6639
ALT-PU-2023-7363
ALT-PU-2023-7774
ALT-PU-2024-13898
ALT-PU-2024-15839
ALT-PU-2024-15840
BDU:2023-07276
CVE-2023-5722
OESA-2025-1265
OESA-2025-1268
OPENSUSE-SU-2023_4214-1
OPENSUSE-SU-2024:13385-1
OPENSUSE-SU-2024:14572-1
SUSE-SU-2023:4212-1
SUSE-SU-2023:4213-1
SUSE-SU-2023:4214-1
USN-6456-1
USN-6456-2

Affected Products

Alt Linux
Astra Linux
Firefox
Linuxmint
Suse
Ubuntu