vulnerability

Red Hat: CVE-2024-1551: Mozilla: Multipart HTTP Responses would accept the Set-Cookie header in response parts (Multiple Advisories)

Try Surface Command

Back to search

Severity	CVSS	Published	Added	Modified
6	(AV:N/AC:L/Au:N/C:P/I:P/A:N)	2024-02-20	2024-02-23	2024-09-03

Severity

CVSS

(AV:N/AC:L/Au:N/C:P/I:P/A:N)

Published

2024-02-20

Added

2024-02-23

Modified

2024-09-03

Description

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of the response body, they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox

Solution(s)

redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-firefox-x11redhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource

References

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today