CVE-2013-1697

Estado: ModificadaAlta (9.3)—
The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Puntuación base: 9.3
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 3.17%
Percentil entre todas las CVEs puntuadas: 88
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (3)

Mozilla — Firefox Mozilla — Thunderbird Mozilla — Thunderbird ESR
CWE

CWE-264
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1697",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-06-26T03:19:10.903",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2716",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2720",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/60784",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1890-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1891-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2716",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2720",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/60784",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1890-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1891-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method."
    },
    {
      "lang": "es",
      "value": "La implementación XrayWrapper en Mozilla Firefox anterior a v22.0, Firefox ESR v17.x antes de v17.0.7, Thunderbird anterior a v17.0.7 no restringe correctamente el uso de DefaultValue para las llamadas a métodos, lo que permite a atacantes remotos ejecutar código JavaScript con privilegios de chrome a través de sitios web manipulados que dispara el uso de los métodos user-defined (1) toString o (2) valueOf"
    }
  ],
  "lastModified": "2026-06-16T23:51:56.553",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29071754-CC8F-42D9-82D4-140236802506",
              "versionEndIncluding": "21.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5657779C-19F9-42B8-BBBD-292B898E8FD2"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EEA3B9F4-BD8E-488B-A362-0B86BC6DA275"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A91BD4A-76BD-40B9-9E12-22CACAAE42BF"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C8122DC-6877-4EC8-8041-B579FC5AC6CA",
              "versionEndIncluding": "17.0.6"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FB95E8B-CF01-471F-8306-BB9FB0896904"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF7E092E-BCBE-48B4-8F6A-D3E4A0369AE1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB1D90B0-9E81-4828-8122-A66FB0953863"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "86C07513-8F98-4FA6-837D-7D735AE5EA91"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E1D87C70-0EC2-49DE-A59D-CAF22760BC9D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61AE2EAA-55A4-4FC9-BC3F-0FEE5BB2DE99"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}