CVE-2024-6611

2024-07-0915:15:13

Alpine Linux Development Team

security.alpinelinux.org

cross-site navigation

firefox vulnerability

samesite cookies

nested iframe

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

Percentile

16.0%

JSON

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

OSVersionArchitecturePackageVersionFilename
Alpine3.20-communitynoarchfirefox= 126.0.1-r0UNKNOWN
Alpine3.20-communitynoarchthunderbird= 115.11.0-r0UNKNOWN