{"id":"CVE-2023-29547","state":"PUBLISHED","title":"When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a","description":"When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.","publishedAt":"2023-06-02T00:00:00.000Z","updatedAt":"2025-01-10T19:15:22.880Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"mozilla","products":["Mozilla Firefox for Android","Mozilla Firefox","Mozilla Focus for Android"],"affected":[{"vendor":"Mozilla","product":"Firefox for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"112","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"112","versionType":"custom"}]},{"vendor":"Mozilla","product":"Focus for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"112","versionType":"custom"}]}],"references":["https://www.mozilla.org/security/advisories/mfsa2023-13/","https://bugzilla.mozilla.org/show_bug.cgi?id=1783536"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/29xxx/CVE-2023-29547.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-29547","state":"PUBLISHED","datePublished":"2023-06-02T00:00:00.000Z","dateUpdated":"2025-01-10T19:15:22.880Z","assignerShortName":"mozilla","assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateReserved":"2023-04-07T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112."}],"affected":[{"vendor":"Mozilla","product":"Firefox for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"112","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"112","versionType":"custom"}]},{"vendor":"Mozilla","product":"Focus for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"112","versionType":"custom"}]}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2023-13/"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1783536"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"Secure document cookie could be spoofed with insecure cookie"}]}],"providerMetadata":{"shortName":"mozilla","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateUpdated":"2023-06-02T00:00:00.000Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2023-13/","tags":["x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1783536","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T14:14:38.812Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-01-10T19:14:21.342234Z","id":"CVE-2023-29547","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"type":"CWE","lang":"en","description":"CWE-noinfo Not enough information"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-10T19:15:22.880Z"}}]}}}