Skip to main content

Thunderbird CVE-2025-8037

CRITICAL
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614)
2025-07-22 security@mozilla.org
Mozilla Information Disclosure Thunderbird Red Hat Suse
Critical
Disputed · 9.1 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE
CRITICAL
qualitative
Red Hat
6.1 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
Analysis Generated
Apr 13, 2026 - 15:41 vuln.today

DescriptionCVE.org

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set over HTTP and the shadowed cookie included the Secure attribute. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.

AnalysisAI

Cookie shadowing in Mozilla Firefox (versions prior to 141 and ESR prior to 140.1) and Thunderbird (versions prior to 141 and ESR prior to 140.1) allows remote unauthenticated attackers to bypass Secure cookie protections and access or modify session data. A nameless cookie containing an equals sign set over insecure HTTP can override cookies with the Secure attribute, enabling session hijacking or authentication bypass. No public exploit identified at time of analysis, though the attack complexity is low (CVSS AC:L) with network-based attack vector requiring no user interaction.

Technical ContextAI

This vulnerability exploits cookie parsing logic in Mozilla's network stack (CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute). The core issue involves how Firefox and Thunderbird handle malformed cookies: specifically, nameless cookies (cookies without a name before the equals sign) that contain an equals sign in their value portion. Due to incorrect precedence handling in the cookie jar implementation, these malformed cookies can shadow legitimate cookies even when the legitimate cookie includes security attributes like 'Secure' (which should restrict the cookie to HTTPS-only transmission). The vulnerability affects both Firefox ESR (Extended Support Release) and standard release channels, as well as Thunderbird email client which shares Mozilla's networking code. The CPE strings identify affected products as mozilla:firefox (both standard and ESR builds) and mozilla:thunderbird (both standard and ESR builds), all versions prior to the January 2025 patches.

RemediationAI

Vendor-released patches are available: upgrade Firefox to version 141 or later, Firefox ESR to version 140.1 or later, Thunderbird to version 141 or later, or Thunderbird ESR to version 140.1 or later. Organizations should prioritize immediate deployment of these updates through existing patch management systems, particularly for Firefox ESR and Thunderbird ESR channels commonly used in enterprise environments. No effective workarounds exist beyond upgrading, as the vulnerability resides in core cookie handling logic that cannot be disabled without breaking legitimate functionality. Detailed advisory information and download links are available at Mozilla Security Advisories MFSA2025-56, MFSA2025-59, MFSA2025-61, and MFSA2025-63 (https://www.mozilla.org/security/advisories/). System administrators should verify successful update deployment and confirm running patched versions through browser/client version checks.

More in Thunderbird

View all
CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

CVE-2022-26485 HIGH POC
8.8 Dec 22

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS

Same weakness CWE-614 – Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

View all
CVE-2020-27651 HIGH POC
8.1
CVE-2024-10718 HIGH POC
7.5
CVE-2022-4409 HIGH POC
7.5
CVE-2022-3174 HIGH POC
7.5
CVE-2021-3882 MEDIUM POC
6.8
CVE-2022-4683 MEDIUM POC
6.5
CVE-2024-47833 MEDIUM POC
6.3
CVE-2023-5866 MEDIUM POC
5.7

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Affected
Image SLES15-SP6-SAP-Azure-LI-BYOS Image SLES15-SP6-SAP-Azure-LI-BYOS-Production Image SLES15-SP6-SAP-Azure-VLI-BYOS Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Affected
SUSE Enterprise Storage 7.1 Fixed

Share

CVE-2025-8037 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy