medium4.3Public exploit code
CVE-2012-5851
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflec…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WebKit Cross-Site Scripting Filter - 'Cross-Site ScriptingAuditor.cpp' Security Bypass2012-07-19 · webapps · php · Verified
Impact
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Webkit | All versions |
| Chrome | through 22.0.1229.96 Versions 22.0.1229.0, 22.0.1229.1, 22.0.1229.2, 22.0.1229.3, 22.0.1229.4 | |
| Apple | Safari | Version 5.1.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html
- https://bugs.webkit.org/show_bug.cgi?id=92692
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80072
- http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html
- https://bugs.webkit.org/show_bug.cgi?id=92692
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80072