firebase

firebase

NPMNPM
NPMwww.npmjs.com
firebase.google.comfirebase.google.com
Releases4.21K
Frequency1 day 6 hours
Last Release
Firebase JavaScript library for web and Node.js
Log in to subscribe

CVE History

CVEAffectedPublishedCVSS v3CVSS v2
CVE-2024-11023OSV↗
< 10.9.06.1 MEDIUM—

Firebase JavaScript SDK utilizes a "FIREBASE_DEFAULTS" cookie to store configuration data, including an "_authTokenSyncURL" field used for session synchronization. If this cookie field is preset via an attacker by any other method, the attacker can manipulate the "_authTokenSyncURL" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0.