CVE-2023-4055

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent with expected cookie jar state. This could have caused requests to be sent with some cookies missing. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox ESR < 115.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 116
Mozilla	Firefox ESR	>= unspecified, < 102.14
Mozilla	Firefox ESR	>= unspecified, < 115.1
mozilla	firefox	< 116
mozilla	firefox_esr	< 102.14; < 115.1

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1782561Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
https://www.debian.org/security/2023/dsa-5464Third Party Advisory
https://www.debian.org/security/2023/dsa-5469Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1782561Issue Tracking, Permissions Required
https://lists.debian.org/debian-lts-announce/2023/08/msg00008.html
https://lists.debian.org/debian-lts-announce/2023/08/msg00010.html
https://www.debian.org/security/2023/dsa-5464Third Party Advisory
https://www.debian.org/security/2023/dsa-5469Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2023-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-30/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-31/Vendor Advisory

Timeline

Published: Aug 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-405505.5An out-of-bounds read flaw was found in Shim when it tried to validate the SBAT information. This issue may expose sensitive data during the CVE-2023-405515.1A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data CVE-2023-405524.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gurcharan Singh Fitness calculators plugin plugin <= 2.0.7 versions.CVE-2023-405536.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Plausible.Io Plausible Analytics plugin <= 1.3.3 versions.CVE-2023-405546.1Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Blog2Social, Adenion Blog2Social: Social Media Auto Post & Scheduler plugin <=CVE-2023-405559.8Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatso CVE-2023-405568.8Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.CVE-2023-405575.4Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Inje CVE-2023-405588.8Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.CVE-2023-405598.8Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Dynamic Pricing and Discount Rules for WooCommerce plugin <= 2.4.0 versions.CVE-2023-40569.8Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. Some of these b CVE-2023-405604.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.