CVE-2012-4904

Cross-application scripting vulnerability in Google Chrome before 18.0.1025308 on Android allows remote attackers to inject arbitrary web script via unspecified vectors, as demonstrated by "Universal XSS (UXSS)" attacks against the current tab.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html	Vendor Advisory
https://code.google.com/p/chromium/issues/detail?id=138035
http://googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html	Vendor Advisory
https://code.google.com/p/chromium/issues/detail?id=138035

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

cpe:2.3:o:google:android:*:*:*:*:*:*:*:*

History

21 Nov 2024, 01:43

Type	Values Removed	Values Added
References	~~() http://googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html - Vendor Advisory~~	() http://googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html - Vendor Advisory
References	~~() https://code.google.com/p/chromium/issues/detail?id=138035 -~~	() https://code.google.com/p/chromium/issues/detail?id=138035 -

Information

Published : 2012-09-13 20:55

Updated : 2024-11-21 01:43

NVD link : CVE-2012-4904

Mitre link : CVE-2012-4904

CVE.ORG link : CVE-2012-4904

JSON object : View

Products Affected

google

android
chrome

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2012-4904", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2012-09-13T20:55:01.557", "references": [{"url": "http://googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://code.google.com/p/chromium/issues/detail?id=138035", "source": "cve@mitre.org"}, {"url": "http://googlechromereleases.blogspot.com/2012/09/chrome-for-android-update.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://code.google.com/p/chromium/issues/detail?id=138035", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-application scripting vulnerability in Google Chrome before 18.0.1025308 on Android allows remote attackers to inject arbitrary web script via unspecified vectors, as demonstrated by \"Universal XSS (UXSS)\" attacks against the current tab."}, {"lang": "es", "value": "Una vulnerabilidad de ejecuci\u00f3n de scripts entre aplicaciones en Google Chrome antes de v18.0.1025308 para Android permite a atacantes remotos inyectar secuencias de comandos web a trav\u00e9s de vectores no especificados, como se demostr\u00f3 con ataques \"Universal XSS (UXSS)\" contra la pesta\u00f1a actual.\r\n"}], "lastModified": "2024-11-21T01:43:43.693", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1AD304AD-1B29-435C-938E-DA4FCF886FEA", "versionEndIncluding": "18.0.1025306"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8255F035-04C8-4158-B301-82101711939C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}