CVE-2013-0793

Firefox < 20.0 - Cross-Site Scripting via Address Bar Spoofing

Title source: llm
STIX 2.1

Description

Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site scripting (XSS) attacks or phishing attacks by leveraging control over navigation timing.

References (13)

Core 13
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0696.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0697.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1791-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2699
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/58837
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=803870
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16928
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-06/msg00012.html

Scores

EPSS 0.0219
EPSS Percentile 80.4%

Details

CWE
CWE-79
Status published
Products (29)
mozilla/firefox 19.0
mozilla/firefox 19.0.1
mozilla/firefox 17.0
mozilla/firefox 17.0.1
mozilla/firefox 17.0.2
mozilla/firefox 17.0.3
mozilla/firefox 17.0.4
mozilla/firefox < 19.0.2
mozilla/seamonkey 2.0 (8 CPE variants)
mozilla/seamonkey 2.0.1
... and 19 more
Published Apr 03, 2013
Tracked Since Feb 18, 2026