Search for vulnerabilities
Vulnerability details: VCID-kjd1-nx9e-ebad
Vulnerability ID VCID-kjd1-nx9e-ebad
Aliases CVE-2013-1670
Summary Security researcher Cody Crews reported a method to call a content level constructor that allows for this constructor to have chrome privileged accesss. This affects chrome object wrappers (COW) and allows for write actions on objects when only read actions should be allowed. This can lead to cross-site scripting (XSS) attacks. In general these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled, but are potentially a risk in browser or browser-like contexts.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
epss 0.45979 https://api.first.org/data/v1/epss?cve=CVE-2013-1670
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2013-42
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2013-1670.json
https://api.first.org/data/v1/epss?cve=CVE-2013-1670
962596 https://bugzilla.redhat.com/show_bug.cgi?id=962596
CVE-2013-1670 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1670
CVE-2013-1670;OSVDB-93427 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/34363.rb
mfsa2013-42 https://www.mozilla.org/en-US/security/advisories/mfsa2013-42
RHSA-2013:0820 https://access.redhat.com/errata/RHSA-2013:0820
RHSA-2013:0821 https://access.redhat.com/errata/RHSA-2013:0821
USN-1822-1 https://usn.ubuntu.com/1822-1/
USN-1823-1 https://usn.ubuntu.com/1823-1/
Data source Exploit-DB
Date added Aug. 19, 2014
Description Mozilla Firefox - toString console.time Privileged JavaScript Injection (Metasploit)
Ransomware campaign use Known
Source publication date Aug. 19, 2014
Exploit type remote
Platform multiple
Source update date Aug. 19, 2014
Exploit Prediction Scoring System (EPSS)
Percentile 0.97524
EPSS Score 0.45979
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:10:17.834300+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2013/mfsa2013-42.md 37.0.0