Vulnerability Details : CVE-2012-3993

Public exploit exists!
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.
Published 2012-10-10 17:55:02
Updated 2020-08-13 20:43:34
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2012-3993

Exploit prediction scoring system (EPSS) score for CVE-2012-3993

EPSS FAQ
1.47%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2012-3993

  • Firefox 5.0 - 15.0.1 __exposedProps__ XCS Code Execution
    Disclosure Date: 2013-08-06
    First seen: 2020-04-26
    exploit/multi/browser/firefox_proto_crmfrequest
    On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given invalid input, would throw an exception that did not have an __exposedProps__ property set. By re-setting this property on the exception object's prototype, the chrome-based defineProper

CVSS scores for CVE-2012-3993

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.3
 HIGH AV:N/AC:M/Au:N/C:C/I:C/A:C
8.6
10.0
 NIST

CWE ids for CVE-2012-3993

  • The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2012-3993

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close