CVE-2024-6611

Description

A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128 and Thunderbird < 128.

Reserved 2024-07-09 | Published 2024-07-09 | Updated 2024-10-25 | Assigner mozilla

Problem types

Incorrect handling of SameSite cookies

Product status

Any version before 128
affected

Any version before 128
affected

Credits

Pedro Bernardo

References

bugzilla.mozilla.org/show_bug.cgi?id=1844827

www.mozilla.org/security/advisories/mfsa2024-29/

www.mozilla.org/security/advisories/mfsa2024-32/

cve.org (CVE-2024-6611)

nvd.nist.gov (CVE-2024-6611)

Download JSON