CVE-2013-1692: CSRF
First published: Wed Jun 26 2013(Updated: )
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <=21.0 | |
| Mozilla Firefox | =19.0 | |
| Mozilla Firefox | =19.0.1 | |
| Mozilla Firefox | =19.0.2 | |
| Mozilla Firefox | =20.0 | |
| Mozilla Firefox | =20.0.1 | |
| Mozilla Firefox ESR | =17.0 | |
| Mozilla Firefox ESR | =17.0.1 | |
| Mozilla Firefox ESR | =17.0.2 | |
| Mozilla Firefox ESR | =17.0.3 | |
| Mozilla Firefox ESR | =17.0.4 | |
| Mozilla Firefox ESR | =17.0.5 | |
| Mozilla Firefox ESR | =17.0.6 | |
| Mozilla Thunderbird | <=17.0.6 | |
| Mozilla Thunderbird | =17.0 | |
| Mozilla Thunderbird | =17.0.1 | |
| Mozilla Thunderbird | =17.0.2 | |
| Mozilla Thunderbird | =17.0.3 | |
| Mozilla Thunderbird | =17.0.4 | |
| Mozilla Thunderbird | =17.0.5 | |
| Mozilla Thunderbird ESR | =17.0 | |
| Mozilla Thunderbird ESR | =17.0.1 | |
| Mozilla Thunderbird ESR | =17.0.2 | |
| Mozilla Thunderbird ESR | =17.0.3 | |
| Mozilla Thunderbird ESR | =17.0.4 | |
| Mozilla Thunderbird ESR | =17.0.5 | |
| Mozilla Thunderbird ESR | =17.0.6 | |
| Mozilla Firefox | =17.0 | |
| Mozilla Firefox | =17.0.1 | |
| Mozilla Firefox | =17.0.2 | |
| Mozilla Firefox | =17.0.3 | |
| Mozilla Firefox | =17.0.4 | |
| Mozilla Firefox | =17.0.5 | |
| Mozilla Firefox | =17.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2013-0981.html
- http://rhn.redhat.com/errata/RHSA-2013-0982.html
- http://www.debian.org/security/2013/dsa-2716
- http://www.debian.org/security/2013/dsa-2720
- http://www.mozilla.org/security/announce/2013/mfsa2013-54.html
- http://www.securityfocus.com/bid/60783
- http://www.ubuntu.com/usn/USN-1890-1
- http://www.ubuntu.com/usn/USN-1891-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=866915
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17096
Frequently Asked Questions
What is the severity of CVE-2013-1692?
CVE-2013-1692 has a moderate severity as it allows for potential cross-site request forgery (CSRF) attacks.
How do I fix CVE-2013-1692?
To fix CVE-2013-1692, update affected versions of Mozilla Firefox, Firefox ESR, and Thunderbird to the latest version.
Which versions are affected by CVE-2013-1692?
CVE-2013-1692 affects Mozilla Firefox versions before 22.0, Firefox ESR versions before 17.0.7, and Thunderbird versions before 17.0.7.
What types of applications are impacted by CVE-2013-1692?
CVE-2013-1692 impacts Mozilla Firefox, Firefox ESR, Thunderbird, and Thunderbird ESR applications.
What could be the consequences of CVE-2013-1692?
The consequences of CVE-2013-1692 include the potential for attackers to manipulate user actions through cross-site request forgery attacks.
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/author
- agent/last-modified-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/source
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/21.0
- version/mozilla firefox/19.0
- version/mozilla firefox/19.0.1
- version/mozilla firefox/19.0.2
- version/mozilla firefox/20.0
- version/mozilla firefox/20.0.1
- canonical/mozilla firefox esr
- version/mozilla firefox esr/17.0
- version/mozilla firefox esr/17.0.1
- version/mozilla firefox esr/17.0.2
- version/mozilla firefox esr/17.0.3
- version/mozilla firefox esr/17.0.4
- version/mozilla firefox esr/17.0.5
- version/mozilla firefox esr/17.0.6
- canonical/mozilla thunderbird
- version/mozilla thunderbird/17.0.6
- version/mozilla thunderbird/17.0
- version/mozilla thunderbird/17.0.1
- version/mozilla thunderbird/17.0.2
- version/mozilla thunderbird/17.0.3
- version/mozilla thunderbird/17.0.4
- version/mozilla thunderbird/17.0.5
- canonical/mozilla thunderbird esr
- version/mozilla thunderbird esr/17.0
- version/mozilla thunderbird esr/17.0.1
- version/mozilla thunderbird esr/17.0.2
- version/mozilla thunderbird esr/17.0.3
- version/mozilla thunderbird esr/17.0.4
- version/mozilla thunderbird esr/17.0.5
- version/mozilla thunderbird esr/17.0.6
- version/mozilla firefox/17.0
- version/mozilla firefox/17.0.1
- version/mozilla firefox/17.0.2
- version/mozilla firefox/17.0.3
- version/mozilla firefox/17.0.4
- version/mozilla firefox/17.0.5
- version/mozilla firefox/17.0.6