by Kastro CVE-2024-1554
Mozilla Firefox — The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may c…
Description · from the CVE record
The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contain. Under the correct circumstances, an attacker may have been able to poison the local browser cache by priming it with a `fetch()` response controlled by the additional headers. Upon navigation to the same URL, the user would see the cached response instead of the expected response. This vulnerability affects Firefox < 123.
Affected
ProductAffectedFixed inSource
Firefoxunspecified – < 123123CNA
firefox< 123123CISA-ADP
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total