Mozilla Firefox prior to 35.0, Firefox ESR 31.x prior to 31.4, Thunderbird prior to 31.4, and SeaMonkey prior to 2.32 do not properly interpret Set-Cookie headers within responses that have a 407 (aka Proxy Authentication Required) status code, which allows remote HTTP proxy servers to conduct session fixation attacks by providing a cookie name that corresponds to the session cookie of the origin server.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mozilla seamonkey |
||
mozilla firefox |
||
mozilla firefox esr 31.1.1 |
||
mozilla firefox esr 31.1.0 |
||
mozilla firefox esr 31.0 |
||
mozilla firefox esr 31.3.0 |
||
mozilla firefox esr 31.2 |
||
mozilla thunderbird |
Vulmon