CVE-2012-2899 in Chrome

Sumário

de MITRE

Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL, which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method.

Once again VulDB remains the best source for vulnerability data.

• Reservar: 19/05/2012
• Divulgação: 05/01/2014
• Moderação: aceite
• Entrada: VDB-8641
• CPE: pronto
• CWE: CWE-79 (confirmado)
• CVSS: 6.3 (VulDB)
• EPSS: 0.00813
• KEV: não
• Atividades: muito baixo
• Sector: Transportation, Hospital, ...

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2012-2899
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2012-2899
• CVE Details: https://www.cvedetails.com/cve/CVE-2012-2899/