CVE-2013-1695

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-26 · updated 2026-06-16
Weakness: CWE-264

Description

Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element.

Affected products

Mozilla Firefox: through 21.0; 19.0, 19.0.1, 19.0.2, 20.0, 20.0.1

References

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
http://www.mozilla.org/security/announce/2013/mfsa2013-57.html
http://www.ubuntu.com/usn/USN-1890-1
https://bugzilla.mozilla.org/show_bug.cgi?id=849791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16433
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
http://www.mozilla.org/security/announce/2013/mfsa2013-57.html
http://www.ubuntu.com/usn/USN-1890-1
https://bugzilla.mozilla.org/show_bug.cgi?id=849791
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16433

Get alerted when CVE-2013-1695 or the next vulnerability affects your stack