CVE-2008-7293: Medium severity Mozilla Firefox vulnerability
Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-7293?
CVE-2008-7293 is considered a moderate severity vulnerability as it allows man-in-the-middle attacks to manipulate cookies.
How do I fix CVE-2008-7293?
To fix CVE-2008-7293, upgrade to Mozilla Firefox version 4 or later, which properly implements HTTP Strict Transport Security.
What versions of Firefox are affected by CVE-2008-7293?
CVE-2008-7293 affects all versions of Mozilla Firefox prior to version 4.0.
What type of attack can exploit CVE-2008-7293?
CVE-2008-7293 can be exploited through man-in-the-middle attacks that overwrite or delete arbitrary cookies.
Is there a workaround for CVE-2008-7293 if I cannot update Firefox?
A workaround for CVE-2008-7293 includes using browser settings to block third-party cookies, but the best solution is to update to a secure version.