CVE-2013-1711

Mozilla: Bypass of XrayWrappers using XBL Scopes (MFSA 2013-70)

Published Aug 7, 2013 CVSS 2.0 · 4.3 Medium EPSS 2.2% KEV · Not listed
Description
The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2013-1738 The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.
Ubuntu USN Ubuntu USN USN-1924-1 Firefox vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Aug 6, 2024, 3:13 PM
Reserved
Feb 13, 2013, 12:00 AM
Status
Modified
Published
Aug 7, 2013, 1:55 AM
Modified
Jun 16, 2026, 11:51 PM
Severity
Moderate
Public date
Aug 6, 2013, 12:00 AM