CVE-2003-0594: Mozilla allows remote attackers to bypass intended cookie access restrictions on a web application via "%2e...

Security readout for executives and security teams

This old Mozilla flaw could make the browser send cookies to parts of a same-server website that should not receive them. If separate applications share a host and rely on cookie path restrictions for isolation, a vulnerable browser could expose sensitive session data across those boundaries. Exposure is most plausible in legacy environments still using affected Mozilla-era browser packages, or frozen systems based on old Red Hat or Mandrake/Mandriva releases. Modern supported browsers are unlikely to be relevant, but the bundle does not provide exact affected or fixed versions. Treat this as a legacy hygiene and architecture-risk item, not an emergency based on the provided evidence. Prioritize if old browser packages remain in use or business applications share a host while relying on path-scoped cookies for separation. Mitigation focus: Retire or upgrade obsolete Mozilla browser packages using vendor guidance.; Review Red Hat and Mandrake/Mandriva advisories for applicable legacy systems.; Avoid relying on cookie Path alone for security isolation between same-host applications..

Prepared

Jun 30, 2026, 06:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.