Vulnerability Description
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 116.0 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1782561Issue TrackingPermissions Required
- https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
- https://www.debian.org/security/2023/dsa-5464Third Party Advisory
- https://www.debian.org/security/2023/dsa-5469Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1782561Issue TrackingPermissions Required
- https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
- https://www.debian.org/security/2023/dsa-5464Third Party Advisory
- https://www.debian.org/security/2023/dsa-5469Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
FAQ
What is CVE-2023-4055?
CVE-2023-4055 is a vulnerability with a CVSS score of 7.5 (HIGH). When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests...
How severe is CVE-2023-4055?
CVE-2023-4055 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-4055?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Debian Debian Linux.