CVEvulnerability
CVE-2013-1710
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-08-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.
Affected configurations
• mozilla seamonkey (<= 2.20)
• mozilla seamonkey 2.0
• mozilla seamonkey 2.0.1
• mozilla seamonkey 2.0.2
• mozilla seamonkey 2.0.3
• mozilla seamonkey 2.0.4
• mozilla seamonkey 2.0.5
• mozilla seamonkey 2.0.6
• mozilla seamonkey 2.0.7
• mozilla seamonkey 2.0.8
• mozilla seamonkey 2.0.9
• mozilla seamonkey 2.0.10
• mozilla seamonkey 2.0.11
• mozilla seamonkey 2.0.12
• mozilla seamonkey 2.0.13
• mozilla seamonkey 2.0.14
• mozilla seamonkey 2.1
• mozilla seamonkey 2.2
• mozilla seamonkey 2.3
• mozilla seamonkey 2.3.1
• mozilla seamonkey 2.3.2
• mozilla seamonkey 2.3.3
• mozilla seamonkey 2.4
• mozilla seamonkey 2.4.1
• mozilla seamonkey 2.5
• mozilla seamonkey 2.6
• mozilla seamonkey 2.6.1
• mozilla seamonkey 2.7
• mozilla seamonkey 2.7.1
• mozilla seamonkey 2.7.2
• mozilla seamonkey 2.8
• mozilla seamonkey 2.9
• mozilla seamonkey 2.9.1
• mozilla seamonkey 2.10
• mozilla seamonkey 2.10.1
• mozilla seamonkey 2.11
• mozilla seamonkey 2.12
• mozilla seamonkey 2.12.1
• mozilla seamonkey 2.13
• mozilla seamonkey 2.13.1
• mozilla seamonkey 2.13.2
• mozilla seamonkey 2.14
• mozilla seamonkey 2.15
• mozilla seamonkey 2.15.1
• mozilla seamonkey 2.15.2
• mozilla seamonkey 2.16
• mozilla seamonkey 2.16.1
• mozilla seamonkey 2.16.2
• mozilla seamonkey 2.17
• mozilla seamonkey 2.17.1
• mozilla seamonkey 2.18
• mozilla seamonkey 2.19
• mozilla seamonkey 2.20
• mozilla thunderbird esr 17.0
• mozilla thunderbird esr 17.0.1
• mozilla thunderbird esr 17.0.2
• mozilla thunderbird esr 17.0.3
• mozilla thunderbird esr 17.0.4
• mozilla thunderbird esr 17.0.5
• mozilla thunderbird esr 17.0.6
… and 24 more
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.debian.org/security/2013/dsa-2735 www.debian.org
- http://www.debian.org/security/2013/dsa-2746 www.debian.org
- http://www.mozilla.org/security/announce/2013/mfsa2013-69.html Vendor Advisory
- http://www.securityfocus.com/bid/61900 www.securityfocus.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=871368 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773 oval.cisecurity.org
- http://www.debian.org/security/2013/dsa-2735 www.debian.org
- http://www.debian.org/security/2013/dsa-2746 www.debian.org
- http://www.mozilla.org/security/announce/2013/mfsa2013-69.html Vendor Advisory
- http://www.securityfocus.com/bid/61900 www.securityfocus.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=871368 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773 oval.cisecurity.org