CVE-2025-8037
BaseFortify
Publication date: 2025-07-22
Last updated on: 2026-04-13
Assigner: Mozilla Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mozilla | firefox | From 60.9.0 (exc) |
| mozilla | firefox | From 60.9.0 (exc) |
| mozilla | thunderbird | to 140.0 (inc) |
| mozilla | thunderbird | to 140.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-614 | The Secure attribute for sensitive cookies in HTTPS sessions is not set. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs when a nameless cookie with an equals sign in its value shadows other cookies. This means that even if the nameless cookie was set over an insecure HTTP connection and the other cookie had the Secure attribute (intended to protect it), the nameless cookie could override or hide the secure cookie. This affects certain versions of Firefox and Thunderbird before version 141 and ESR before 140.1.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a less secure cookie to shadow a more secure cookie, potentially leading to security issues such as session hijacking or unauthorized access, because the Secure attribute on the shadowed cookie may be bypassed.