PT-2013-3358

CVE-2013-1727

Published

2013-09-18

Updated

2013-10-03

Description by

CVSS 2.0

4.0

Medium

MetricsAV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 24.0 on Android

Description The issue allows attackers to bypass the Same Origin Policy, which can lead to cross-site scripting (XSS) attacks or the unauthorized obtaining of password or cookie information. This is achieved by using a symlink in conjunction with a file: URL for a local file.

Recommendations For Mozilla Firefox versions prior to 24.0 on Android, update to version 24.0 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Takeshi Terada

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers