CVE-2011-2993
Estado: ModificadaAlta (9.3)—
The implementation of digital signatures for JAR files in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not prevent calls from unsigned JavaScript code to signed code, which allows remote attackers to bypass the Same Origin Policy and gain privileges via a crafted web site, a different vulnerability than CVE-2008-2801.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
- Puntuación base: 9.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.26%
- Percentil entre todas las CVEs puntuadas: 69
- Fecha de la puntuación: 7/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- CWE-264
Referencias
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=657267
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14055
- http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
- http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=657267
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14055
JSON original (NVD)
Mostrar
{
"id": "CVE-2011-2993",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2011-08-18T18:55:02.023",
"references": [
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.mozilla.org/security/announce/2011/mfsa2011-29.html",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.mozilla.org/security/announce/2011/mfsa2011-33.html",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=657267",
"source": "cve@mitre.org"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14055",
"source": "cve@mitre.org"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00023.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mozilla.org/security/announce/2011/mfsa2011-29.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.mozilla.org/security/announce/2011/mfsa2011-33.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=657267",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14055",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-264"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The implementation of digital signatures for JAR files in Mozilla Firefox 4.x through 5, SeaMonkey 2.x before 2.3, and possibly other products does not prevent calls from unsigned JavaScript code to signed code, which allows remote attackers to bypass the Same Origin Policy and gain privileges via a crafted web site, a different vulnerability than CVE-2008-2801."
},
{
"lang": "es",
"value": "La implementación de firmas digitales para archivos JAR en Firefox versiones 4.x hasta 5, SeaMonkey versiones 2.x anteriores a 2.3, de Mozilla, y posiblemente otros productos no impide las llamadas de código JavaScript sin firmar en código firmado, lo que permite a los atacantes remotos omitir la Política del Mismo Origen y alcanzar privilegios por medio de un sitio web especialmente diseñado, una vulnerabilidad diferente de CVE-2008-2801."
}
],
"lastModified": "2026-06-16T23:32:23.390",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C69962C4-FA56-47F2-82A4-DFF4C19DAF3A"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7BC1684-3634-4585-B7E6-8C8777E1DA0D"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A490D040-EF74-45C2-89ED-D88ADD222712"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6CDA17D1-CD93-401E-860C-7C3291FEEB7E"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6F72FDE3-54E0-48E4-9015-1B8A36DB1EC3"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4062C901-3828-415B-A6C3-EDD0E7B20C0E"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC0D8730-7034-4AD6-9B05-F8BAFB0145EF"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "857AFB05-F0C1-4061-9680-9561D68C908F"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC37EBAF-C979-4ACC-ACA9-BDC2AECCB0D7"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "80801CD8-EEAF-4BC4-9085-DCCC6CF73076"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAF4C78A-5093-4871-AF69-A8E8FD7E1AAE"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "560AD4C7-89D2-4323-BBCC-A89EEB6832CB"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0:beta9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B389CBC-4F6C-4C17-A87B-A6DD92703A10"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:4.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DDFBA043-91BC-4FB5-A34D-FCE1A9C65A88"
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8901A808-66F1-4501-AFF6-6FBB22852855"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58EB8E8A-84DE-43AA-B8F0-B585FB73D724"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C19C0BF7-390D-4E2E-BA32-28DFF73C55F6"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5FE5E50C-80ED-4CA7-BC85-8BD2E324D527"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FEBF912C-A12E-4DBD-84AC-8B440E190BCE"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B8EDED6-29EF-4A9F-955D-F5E6611C2141"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EDC9C82D-586A-48F4-B540-1E2AE79806B3"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51FCF83B-630A-4413-BFAA-0C24A6B8F4F4"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84B2AA0A-0220-49DD-82CD-37FDC563F146"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D754AF10-1E43-46C8-A444-E7DB3401509D"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34182167-F1DF-455B-BFDB-0A8491590479"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8ECA6CE-20D0-4A4F-B376-888A9328B044"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FEFCAB0-E57A-46E8-94C7-8510BB87C6B2"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9FB5C972-AF7B-4EC7-BCE5-867CACCF5C19"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C68DBB31-7804-446E-9A53-073E4B74E851"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31ADCC51-CE05-4EB6-BE8F-B64FD62946A1"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "387390AE-CF25-47ED-BD36-F42455DE1A4B"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78D5F0AD-9974-40A1-942F-0F03A278DAD9"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C388E6F-148E-4EA5-8D82-7778398122BA"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F1FEB21-60B1-4303-BE19-576CC93B940C"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.1:alpha1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "635FCE4C-2D15-4FB2-8917-D176B1539024"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.1:alpha2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E59E74C2-38F2-4B7F-88C0-9919548713B2"
},
{
"criteria": "cpe:2.3:a:mozilla:seamonkey:2.1:alpha3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB6663ED-4643-4BB7-B281-706C7A0E10F3"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}