PT-2013-3358 · Mozilla · Firefox

Takeshi Terada · Publicado 2013-09-18 · Atualizado 2013-10-03 · CVE-2013-1727

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 24.0 on Android

Description The issue allows attackers to bypass the Same Origin Policy, which can lead to cross-site scripting (XSS) attacks or the unauthorized obtaining of password or cookie information. This is achieved by using a symlink in conjunction with a file: URL for a local file.

Recommendations For Mozilla Firefox versions prior to 24.0 on Android, update to version 24.0 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-1727

Produtos afetados

Firefox

Referências · 7

• 🔥 https://exploit-db.com/exploits/38766 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117526.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115907.html · Aviso do Fabricante
• http://mozilla.org/security/announce/2013/mfsa2013-84.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116610.html · Aviso do Fabricante
• https://bugzilla.mozilla.org/show_bug.cgi?id=782581 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1727 · Nota de Segurança