CVE-2024-11023

Katalog CVE

CVSS 6.1 · Medium EPSS 0,13%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada google firebase javascript sdk. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.

Rincian

Terbit di NVD

18 November 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 2,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/firebase/firebase-js-sdk/pull/8056 issue tracking · patch
• https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024 release notes