Main Vulnerability Database Vulnerabilities #VU10198

Security restrictions bypass in Mozilla Firefox - CVE-2018-5114

Published: January 24, 2018

Vulnerability identifier: #VU10198

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-5114

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to an error when the old value of an existing cookie changed to be HttpOnly remains accessible to scripts. A remote attacker can bypass security restrictions and gain access to the application.

Affected software

Mozilla Firefox
Ubuntu

How to mitigate CVE-2018-5114

Update to version 58.0.

External References

https://www.mozilla.org/en-US/security/advisories/mfsa2018-02/

Related Security Bulletins