CVE-2011-2605
mozilla: no CVSS score yet. EPSS 1.0% chance of exploitation in the next 30 days.
CRLF injection vulnerability in the nsCookieService::SetCookieStringInternal function in netwerk/cookie/nsCookieService.cpp in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, and Thunderbird before 3.1.11, allows remote attackers to bypass intended access restrictions via a string containing a \n (newline) character, which is not properly handled in a JavaScript "document.cookie =" expression, a different vulnerability than CVE-2011-2374.
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-11-01)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- mozilla:firefox
- mozilla:thunderbird