CVE-2024-5699

2024-06-1112:40:18

mozilla

www.cve.org

vulnerability

firefox

case-insensitive

cookie prefixes

spec violation

cve-2024-5699

0.0004 Low

EPSS

Percentile

9.1%

JSON

In violation of spec, cookie prefixes such as __Secure were being ignored if they were not correctly capitalized - by spec they should be checked with a case-insensitive comparison. This could have resulted in the browser not correctly honoring the behaviors specified by the prefix. This vulnerability affects Firefox < 127.

CNA Affected

[
  {
    "product": "Firefox",
    "vendor": "Mozilla",
    "versions": [
      {
        "lessThan": "127",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]