CVE-2024-5699

2024-06-1113:15:51

[email protected]

web.nvd.nist.gov

violation of spec

cookie prefixes

ignored

case-insensitive comparison

browser behavior

vulnerability

firefox < 127

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

In violation of spec, cookie prefixes such as __Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127.

Affected configurations

Vulners

Node

mozillafirefoxRange≤127

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "127",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]