Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dbre-65bp-xbf1
Vulnerability ID VCID-dbre-65bp-xbf1
Aliases CVE-2013-6674
Summary Security researcher Fabián Cuchietti discovered that it was possible to bypass the restriction on JavaScript execution in mail by embedding an <iframe> with a data: URL within a message. If the victim replied or forwarded the mail after receiving it, quoting it "in-line" using Thunderbird's HTML mail editor, it would run the attached script. The running script would be restricted to the mail composition window where it could observe and potentially modify the content of the mail before it was sent. Scripts were not executed if the recipient merely viewed the mail, only if it was edited as HTML. Turning off HTML composition prevented the vulnerability and forwarding the mail "as attachment" prevented the forwarding variant.Ateeq ur Rehman Khan of Vulnerability Labs reported additional variants of this attack involving the use of the <object> tag and which could be used to attach object data types such as images, audio, or video.This affected the Thunderbird 17 branch. It was fixed in all versions based on Gecko 23 or later. Thunderbird 24 and later are not affected by this vulnerability.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
epss 0.47529 https://api.first.org/data/v1/epss?cve=CVE-2013-6674
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2014-14
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-6674.json
https://api.first.org/data/v1/epss?cve=CVE-2013-6674
1063120 https://bugzilla.redhat.com/show_bug.cgi?id=1063120
CVE-2013-6674 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6674
CVE-2013-6674;OSVDB-102566 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/31223.txt
CVE-2013-6674;OSVDB-102566 Exploit https://www.vulnerability-lab.com/get_content.php?id=953
mfsa2014-14 https://www.mozilla.org/en-US/security/advisories/mfsa2014-14
RHSA-2013:1823 https://access.redhat.com/errata/RHSA-2013:1823
USN-2119-1 https://usn.ubuntu.com/2119-1/
Data source Exploit-DB
Date added Jan. 27, 2014
Description Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass
Ransomware campaign use Unknown
Source publication date Jan. 27, 2014
Exploit type dos
Platform multiple
Source update date Jan. 27, 2014
Source URL https://www.vulnerability-lab.com/get_content.php?id=953
Exploit Prediction Scoring System (EPSS)
Percentile 0.9768
EPSS Score 0.47529
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:18:15.541044+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2014/mfsa2014-14.md 38.0.0