CVE-2010-5070

The JavaScript implementation in Apple Safari 4 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method, a different vulnerability than CVE-2010-2264. NOTE: this may overlap CVE-2010-5073.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://w2spconf.com/2010/papers/p26.pdf	Exploit
http://w2spconf.com/2010/papers/p26.pdf	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:safari:4.0:::::::*
	cpe:2.3:a:apple:safari:4.0:beta::::::
	cpe:2.3:a:apple:safari:4.0.0b:::::::*
	cpe:2.3:a:apple:safari:4.0.1:::::::*
	cpe:2.3:a:apple:safari:4.0.2:::::::*
	cpe:2.3:a:apple:safari:4.0.3:::::::*
	cpe:2.3:a:apple:safari:4.0.4:::::::*
	cpe:2.3:a:apple:safari:4.0.5:::::::*
	cpe:2.3:a:apple:safari:4.1:::::::*
	cpe:2.3:a:apple:safari:4.1.1:::::::*
	cpe:2.3:a:apple:safari:4.1.2:::::::*
	cpe:2.3:a:apple:safari:4.1.3:::::::*

History

21 Nov 2024, 01:22

Type	Values Removed	Values Added
References	~~() http://w2spconf.com/2010/papers/p26.pdf - Exploit~~	() http://w2spconf.com/2010/papers/p26.pdf - Exploit

Information

Published : 2011-12-07 19:55

Updated : 2024-11-21 01:22

NVD link : CVE-2010-5070

Mitre link : CVE-2010-5070

CVE.ORG link : CVE-2010-5070

JSON object : View

Products Affected

apple

safari

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-5070", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-12-07T19:55:01.423", "references": [{"url": "http://w2spconf.com/2010/papers/p26.pdf", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://w2spconf.com/2010/papers/p26.pdf", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The JavaScript implementation in Apple Safari 4 does not properly restrict the set of values contained in the object returned by the getComputedStyle method, which allows remote attackers to obtain sensitive information about visited web pages by calling this method, a different vulnerability than CVE-2010-2264. NOTE: this may overlap CVE-2010-5073."}, {"lang": "es", "value": "La ejecuci\u00f3n de JavaScript en Apple Safari v4, no restringe adecuadamente el conjunto de valores contenidos en el objeto devuelto por el m\u00e9todo getComputedStyle, lo que permite a atacantes remotos obtener informaci\u00f3n sensible acerca de las p\u00e1ginas web visitadas por llamar a este m\u00e9todo. Una vulnerabilidad diferente de CVE-2010-2264. Esto puede solaparse con CVE-2010-5073."}], "lastModified": "2024-11-21T01:22:26.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:safari:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BDA6DB4-A0DA-43CA-AABD-10EEEEB28EAB"}, {"criteria": "cpe:2.3:a:apple:safari:4.0:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DC87F61-3463-468A-BF0B-070816BBC3CA"}, {"criteria": "cpe:2.3:a:apple:safari:4.0.0b:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02EAC196-AE43-4787-9AF9-E79E2E1BBA46"}, {"criteria": "cpe:2.3:a:apple:safari:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2FD40E4-D4C9-492E-8432-ABC9BD2C7E67"}, {"criteria": "cpe:2.3:a:apple:safari:4.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36EA71E0-63F7-46FF-AF11-792741F27628"}, {"criteria": "cpe:2.3:a:apple:safari:4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80E36485-565D-4FAA-A6AD-57DF42D47462"}, {"criteria": "cpe:2.3:a:apple:safari:4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73E9C17F-C99E-4ABB-B312-31F87BC0C0E8"}, {"criteria": "cpe:2.3:a:apple:safari:4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "46D8318A-9383-42A7-9A6A-2EB2736338B7"}, {"criteria": "cpe:2.3:a:apple:safari:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79DC6C51-CEEA-4CBF-87D2-8007B7C3D67F"}, {"criteria": "cpe:2.3:a:apple:safari:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7B6AD89-D60C-4C8F-A9E6-4380A6B8DB13"}, {"criteria": "cpe:2.3:a:apple:safari:4.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B2451165-7831-426E-BA07-B3A57F3589C5"}, {"criteria": "cpe:2.3:a:apple:safari:4.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "211A142A-CB1E-48DC-AEA1-096F3E750063"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}