CVE-2024-11023

MEDIUM EPSS 2.6%
Published Nov 18, 20241y ago · Modified Jun 17, 20262w ago
5.2 CVSS 4.0
Medium
Find Similar
Published Nov 18, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

CVSS Details

Base Score
5.2
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction A
Scope X

Threat Intelligence

EPSS Exploit Probability
2.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
googlefirebase_javascript_sdk* <10.9.0

References 2

  • firebase.google.com https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024
    Release Notes
  • github.com https://github.com/firebase/firebase-js-sdk/pull/8056
    Issue TrackingPatch

Remediation

  • github.com https://github.com/firebase/firebase-js-sdk/pull/8056
    Issue TrackingPatch