CVE-2013-6673

Published Dec 11, 2013

Last updated 10 months ago

Overview

Description
Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509 certificate, which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.
Source
security@mozilla.org
NVD status
Deferred
Products
fedora, firefox, seamonkey, thunderbird, suse_linux_enterprise_software_development_kit, opensuse, linux_enterprise_desktop, linux_enterprise_server, ubuntu_linux

Risk scores

CVSS 3.1

Type
Primary
Base score
5.9
Impact score
3.6
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity
MEDIUM

CVSS 2.0

Type
Primary
Base score
4.3
Impact score
2.9
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov
CWE-310

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.