CVE-2014-8639
Mozilla: Cookie injection through Proxy Authenticate responses (MFSA 2015-04)
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · January 13, 2015
Updated · June 27, 2026
Description
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')