Mozilla Firefox before 3.6.18, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 do not distinguish between cookies for two domain names that differ only in a trailing dot, which allows remote web servers to bypass the Same Origin Policy via Set-Cookie headers.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2011-06-30 16:55
Updated : 2017-09-19 01:32
NVD link : CVE-2011-2362
Mitre link : CVE-2011-2362
CVE.ORG link : CVE-2011-2362
JSON object : View
Products Affected
mozilla
- thunderbird
- firefox
- seamonkey
CWE
CWE-264
Permissions, Privileges, and Access Controls