peter bassill · operator
$ cve CVE-2013-1670 JSON

CVE-2013-1670 EXPLOIT

4.3
MEDIUM · CVSS 2.0 · EPSS 10.9% (pctl 96)

Patch early

A public exploit exists.

Description

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Scoring

CVSS4.3 (MEDIUM, v2.0)
VectorAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS10.89% — more likely to be exploited than 96% of all CVEs
WeaknessCWE-79
On CISA KEVno
Public exploityes
Published2013-05-16
Last modified2026-06-16

Affected (3)

VendorProduct
mozillafirefox
mozillathunderbird
mozillathunderbird esr

Public exploits

SourceTitleDate
exploit-dbMozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)2014-08-19

References

→ the Explorer  ·  watch your stack  ·  NVD