{"id":"CVE-2013-6674","aliases":["EUVD-2013-6476","GHSA-f33f-rhvc-q7r2","RHSA-2013:1823"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird...","description":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07697,"percentile":0.94638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2014-02-17T22:00:00Z","modified":"2026-06-26T10:23:00Z","exploits":[{"source":"exploitdb","id":"EDB-31223","title":"Mozilla Thunderbird 17.0.6 - Input Validation Filter Bypass","type":"dos","platform":"multiple","date":"2014-01-27","url":"https://www.exploit-db.com/exploits/31223"}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-2.el5_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-2.el5_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-2.el5_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_productivity:5","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-2.el5_10"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-1.el6_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-1.el6_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-1.el6_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-1.el6_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-1.el6_5"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:24.2.0-1.el6_5"}]}],"bundled":9}],"products":[{"vendor":"mozilla","product":"seamonkey"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"mozilla","product":"thunderbird_esr"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2119-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2014/Jan/182","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit"]},{"url":"http://osvdb.org/102566","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securitytracker.com/id/1029773","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2014/mfsa2014-14.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","article"]},{"url":"http://www.kb.cert.org/vuls/id/863369","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://packetstormsecurity.com/files/124965/Mozilla-Thunderbird-Filter-Bypass.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.securitytracker.com/id/1029774","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=868267","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6674","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f33f-rhvc-q7r2"},{"url":"https://access.redhat.com/errata/RHSA-2013:1823","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"http://www.mozilla.org/security/known-vulnerabilities/thunderbirdESR.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039429","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1823.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0772","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=911840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0772","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-22.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-5609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5609","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5609","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-104.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-5612","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5612","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5612","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-106.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-5613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5613","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-114.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-5614","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5614","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5614","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-107.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-5616","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5616","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-108.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-5618","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5618","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-109.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6671","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6671","tags":["advisory"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-111.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6674","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6674","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-6674","description":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.","status":"published","published":"2014-02-17T22:00:00Z","modified":"2024-08-06T17:46:22.408Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2013-6476","description":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.","status":"published","published":"2014-02-17T22:00:00Z","modified":"2024-08-06T17:46:22Z","updated_at":"2026-11-03T01:56:25.766525Z"}],"ghsa":[{"id":"GHSA-f33f-rhvc-q7r2","title":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird...","description":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.","status":"published","published":"2022-05-17T04:10:15Z","modified":"2023-01-28T05:01:13Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:31.331394Z"}],"nvd":[{"id":"CVE-2013-6674","description":"Cross-site scripting (XSS) vulnerability in Mozilla Thunderbird 17.x through 17.0.8, Thunderbird ESR 17.x through 17.0.10, and SeaMonkey before 2.20 allows user-assisted remote attackers to inject arbitrary web script or HTML via an e-mail message containing a data: URL in an IFRAME element, a related issue to CVE-2014-2018.","status":"published","published":"2014-02-17T22:55:04.897Z","modified":"2026-06-17T00:00:47.303Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"RHSA-2013:1823","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2024-09-15T21:13:08Z","modified":"2026-06-26T10:23:00Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}