CVE-2022-40958

By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context could set and thus overwrite cookies from a secure context, leading to session fixation and other attacks. This vulnerability affects Firefox ESR < 102.3, Thunderbird < 102.3, and Firefox < 105.

• CWE-74
• CWE-74

• https://bugzilla.mozilla.org/show_bug.cgi?id=1779993Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2022-40/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-41/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-42/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1779993Issue Tracking, Permissions Required
• https://www.mozilla.org/security/advisories/mfsa2022-40/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-41/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2022-42/Vendor Advisory

Published

Dec 22, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-40946On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 …7.5
• CVE-2022-4095A use-after-free flaw was found in Linux kernel before 5.19.…7.8
• CVE-2022-40954Improper Neutralization of Special Elements used in an OS Co…5.5
• CVE-2022-40955In versions of Apache InLong prior to 1.3.0, an attacker wit…8.8
• CVE-2022-40956When injecting an HTML base element, some requests would ign…6.1
• CVE-2022-40957Inconsistent data in instruction and data cache when creatin…6.5
• CVE-2022-40959During iframe navigation, certain pages did not have their F…6.5
• CVE-2022-4096Server-Side Request Forgery (SSRF) in GitHub repository apps…6.5
• CVE-2022-40960Concurrent use of the URL parser with non-UTF-8 data was not…6.5
• CVE-2022-40961During startup, a graphics driver with an unexpected name co…6.5
• CVE-2022-40962Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian H…8.8
• CVE-2022-40963Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) v…5.4