CVE-2013-1737

CVE Database · CVE-2013-1737

CVE-2013-1737

· N/AModified

CVSS v3.1

N/A

EPSS

2.93%

Published

Sep 18, 2013

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.

Weaknesses (CWE)

CWE-264

Affected Products (137)

mozilla · thunderbird_esrvulnerable

mozilla · seamonkeyvulnerable

References (20)

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115907.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116610.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117526.html

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html

http://lists.opensuse.org/opensuse-updates/2013-09/msg00055.html

http://lists.opensuse.org/opensuse-updates/2013-09/msg00057.html

http://lists.opensuse.org/opensuse-updates/2013-09/msg00059.html

http://lists.opensuse.org/opensuse-updates/2013-09/msg00060.html

http://lists.opensuse.org/opensuse-updates/2013-09/msg00061.html

http://rhn.redhat.com/errata/RHSA-2013-1268.html

KEV Catalog EPSS Scores Vendors All CVEs