CVE-2024-1551 Information

Description

Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header as well as control part of the response body they could inject Set-Cookie response headers that would have been honored by the browser. This vulnerability affects Firefox < 123 Firefox ESR < 115.8 and Thunderbird < 115.8.

Reference

https://bugzilla.mozilla.org/show_bug.cgi?id=1864385 https://www.mozilla.org/security/advisories/mfsa2024-05/ https://www.mozilla.org/security/advisories/mfsa2024-06/ https://www.mozilla.org/security/advisories/mfsa2024-07/