CVE-2023-4055
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
CVE-2023-4055 affects the Firefox browser, where exceeding the number of cookies per domain leads to inconsistencies in the sent cookies. As a result, some requests may be sent with missing cookies.
Risk Assessment
For organizations, this poses a risk of session or authorization data loss, potentially leading to unauthorized access to resources.
Recommendation
It is recommended to update the Firefox browser to version 116 or newer and Firefox ESR to version 102.14 or 115.1 to mitigate this vulnerability.
Other vulnerabilities in Firefox < 116, Firefox ESR < 102.14, Firefox ESR < 115.1
See all- CVE-2023-4050High
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This could lead to a crash that potentially allows for a sandbox escape.
- CVE-2023-4046Medium
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in incorrect compilation and a potentially exploitable crash in the content process.
- CVE-2023-4045Medium
CVE-2023-4045 concerns improper tracking of cross-origin tainting in Offscreen Canvas, which could allow unauthorized access to image data from other sites, violating same-origin policy.
Original NVD description (English source)
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.