CVE-2013-0795

Firefox < 20.0 - Same Origin Policy Bypass via SOW cloneNode Method

Title source: llm
STIX 2.1

Description

The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.

References (12)

Core 12
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0696.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0697.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1791-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2699
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=825697
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-06/msg00012.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16842

Scores

EPSS 0.0343
EPSS Percentile 87.6%

Details

CWE
CWE-264
Status published
Products (29)
mozilla/firefox 19.0
mozilla/firefox 19.0.1
mozilla/firefox 17.0
mozilla/firefox 17.0.1
mozilla/firefox 17.0.2
mozilla/firefox 17.0.3
mozilla/firefox 17.0.4
mozilla/firefox < 19.0.2
mozilla/seamonkey 2.0 (8 CPE variants)
mozilla/seamonkey 2.0.1
... and 19 more
Published Apr 03, 2013
Tracked Since Feb 18, 2026