CVE-2013-1671

Published: May 16, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site.

Affected (5)

Products: Mozilla: Firefox

Mozilla

1 product

Firefox

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 20.0.1
Mozilla Firefox	Version 19.0.1
Mozilla Firefox	Version 19.0.2
Mozilla Firefox	Version 19.0
Mozilla Firefox	Version 20.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (12)

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html

Source: security@mozilla.org

http://www.mozilla.org/security/announce/2013/mfsa2013-43.html

Source: security@mozilla.org

Vendor Advisory

http://www.ubuntu.com/usn/USN-1822-1

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=842255

Source: security@mozilla.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17100

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html