PT-2013-3358 · Mozilla · Firefox

Takeshi Terada · Published 2013-09-18 · Updated 2013-10-03 · CVE-2013-1727

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 24.0 on Android

Description The issue allows attackers to bypass the Same Origin Policy, which can lead to cross-site scripting (XSS) attacks or the unauthorized obtaining of password or cookie information. This is achieved by using a symlink in conjunction with a file: URL for a local file.

Recommendations For Mozilla Firefox versions prior to 24.0 on Android, update to version 24.0 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-1727

Affected Products

Firefox

References · 7

• 🔥 https://exploit-db.com/exploits/38766 · Exploit
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117526.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115907.html · Vendor Advisory
• http://mozilla.org/security/announce/2013/mfsa2013-84.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116610.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1727 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=782581 · Note