VDB
CVE-2013-6674
CVE-2013-6674
PUBLISHED
CVSS 4.300000190734863 MEDIUM
Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.
EPSS 7.70% · 94.4th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
7.70%
94.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mozilla | seamonkey | 2.16, 2.16, 2.17 |
| mozilla | thunderbird_esr | 17.0, 17.0.1, 17.0.2 |
| n/a | n/a | n/a |
| mozilla | thunderbird | 17.0.2, 17.0.5, 17.0.6 |
Timeline
- Feb 17, 2014 CVE Published
- Feb 4, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
- Sep 8, 2023 EPSS Score
- Dec 23, 2023 EPSS Score
- Dec 31, 2023 EPSS Score
References
- http://packetstormsecurity.com/files/124965/Mozilla-Thunderbird-Filter-Bypass.html url
- USN-2119-1 vendor-advisory
- 20140127 Mozilla Bug Bounty #5 - WireTap Remote Web Vulnerability mailing-list
- 102566 vdb
- 1029773 vdb
- http://www.mozilla.org/security/announce/2014/mfsa2014-14.html url
- VU#863369 third-party-advisory
- 1029774 vdb
- https://bugzilla.mozilla.org/show_bug.cgi?id=868267 url
- https://nvd.nist.gov/vuln/detail/CVE-2013-6674 advisory