4.3
CVE-2013-1709
- EPSS 0.52%
- Published 07.08.2013 01:55:04
- Last modified 11.04.2025 00:51:21
- Source security@mozilla.org
- Teams watchlist Login
- Open Login
Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving spoofing a relative location in a previously visited document.
Data is provided by the National Vulnerability Database (NVD)
Mozilla ≫ Thunderbird Version <= 17.0.7
Mozilla ≫ Thunderbird Version17.0
Mozilla ≫ Thunderbird Version17.0.1
Mozilla ≫ Thunderbird Version17.0.2
Mozilla ≫ Thunderbird Version17.0.3
Mozilla ≫ Thunderbird Version17.0.4
Mozilla ≫ Thunderbird Version17.0.5
Mozilla ≫ Thunderbird Version17.0.6
Mozilla ≫ Thunderbird Esr Version17.0
Mozilla ≫ Thunderbird Esr Version17.0.1
Mozilla ≫ Thunderbird Esr Version17.0.2
Mozilla ≫ Thunderbird Esr Version17.0.3
Mozilla ≫ Thunderbird Esr Version17.0.4
Mozilla ≫ Thunderbird Esr Version17.0.5
Mozilla ≫ Thunderbird Esr Version17.0.6
Mozilla ≫ Thunderbird Esr Version17.0.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.52% | 0.658 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.