What is CVE-2013-0793?

CVE-2013-0793 is a vulnerability in Mozilla Firefox, classified under Cross-site Scripting. Published 2013-04-03.

Is CVE-2013-0793 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XSS in Mozilla Firefox

CVE-2013-0793

Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site scripting (XSS) attacks or phishing attacks by leveraging control over navigation timing.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2013-04-03 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.022 (81.8th percentile), scored 2026-10-02.

Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000

Affected products

Mozilla Firefox — versions 19.0, 19.0.1, 17.0
Mozilla Seamonkey — versions 2.0, 2.0.1, 2.0.2
Mozilla Thunderbird — versions 17.0, 17.0.1, 17.0.2
Mozilla Thunderbird Esr — versions 17.0, 17.0.1, 17.0.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

Public proof-of-concept exploits

bondhan/xml2json

References

lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html (vendor-advisory)
www.ubuntu.com/usn/USN-1791-1 (vendor-advisory)
www.debian.org/security/2013/dsa-2699 (vendor-advisory)
www.securityfocus.com/bid/58837 (vdb-entry)
bugzilla.mozilla.org/show_bug.cgi
lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html (vendor-advisory)
oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:16928 (signature, vdb-entry)
rhn.redhat.com/errata/RHSA-2013-0696.html (vendor-advisory)
www.mozilla.org/security/announce/2013/mfsa2013-38.html (Vendor Advisory)
lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html (vendor-advisory)

Frequently asked questions

What is CVE-2013-0793?: CVE-2013-0793 is a vulnerability in Mozilla Firefox, classified under Cross-site Scripting. Published 2013-04-03.
Is CVE-2013-0793 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.