製品・ソフトウェアに関する情報

JVN脆弱性詳細

WebKit におけるクロスサイトスクリプティング (XSS) 保護メカニズムを回避される脆弱性

Title	WebKit におけるクロスサイトスクリプティング (XSS) 保護メカニズムを回避される脆弱性
Summary	Google Chrome および Apple Safari で使用される WebKit の WebCore 内の html/parser/XSSAuditor.cpp は、反射データの出力可能なコンテキスト全てに配慮しないため、クロスサイトスクリプティング (XSS) 保護メカニズムを回避される脆弱性が存在します。
Possible impacts	第三者により、巧妙に細工された文字列を介して、クロスサイトスクリプティング (XSS) 保護メカニズムを回避される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Nov. 15, 2012, midnight
Registration Date	Nov. 16, 2012, 2:34 p.m.
Last Update	Nov. 16, 2012, 2:34 p.m.

CVSS2.0 : 警告
Score	4.3
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected System

アップル

Safari 5.1.7

WebKit

Google

Google Chrome 22

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-5851	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5851
National Vulnerability Database (NVD)
2	CVE-2012-5851	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5851

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Google
1	Google Chrome	http://www.google.co.jp/chrome/intl/ja/landing_ff_yt.html?hl=ja&hl=ja
webkit.org
2	Bug 92692	https://bugs.webkit.org/show_bug.cgi?id=92692

Change Log

No	Changed Details	Date of change
0	[2012年11月16日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-5851

Summary	html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
Publication Date	Nov. 15, 2012, 8:58 p.m.
Registration Date	Jan. 28, 2021, 3:06 p.m.
Last Update	Nov. 21, 2024, 10:45 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome:22.0.1229.23:::::::*
cpe:2.3:a:google:chrome:22.0.1229.63:::::::*
cpe:2.3:a:google:chrome:22.0.1229.18:::::::*
cpe:2.3:a:google:chrome:22.0.1229.33:::::::*
cpe:2.3:a:google:chrome:22.0.1229.9:::::::*
cpe:2.3:a:google:chrome:22.0.1229.57:::::::*
cpe:2.3:a:google:chrome:22.0.1229.32:::::::*
cpe:2.3:a:google:chrome:22.0.1229.54:::::::*
cpe:2.3:a:google:chrome:22.0.1229.16:::::::*
cpe:2.3:a:google:chrome:22.0.1229.4:::::::*
cpe:2.3:a:google:chrome:22.0.1229.21:::::::*
cpe:2.3:a:google:chrome:22.0.1229.95:::::::*
cpe:2.3:a:google:chrome:22.0.1229.78:::::::*
cpe:2.3:a:google:chrome:22.0.1229.12:::::::*
cpe:2.3:a:google:chrome:22.0.1229.31:::::::*
cpe:2.3:a:google:chrome:22.0.1229.92:::::::*
cpe:2.3:a:google:chrome:22.0.1229.89:::::::*
cpe:2.3:a:google:chrome:22.0.1229.10:::::::*
cpe:2.3:a:google:chrome:22.0.1229.2:::::::*
cpe:2.3:a:google:chrome:22.0.1229.22:::::::*
cpe:2.3:a:google:chrome:22.0.1229.35:::::::*
cpe:2.3:a:google:chrome:22.0.1229.50:::::::*
cpe:2.3:a:google:chrome:22.0.1229.36:::::::*
cpe:2.3:a:google:chrome:22.0.1229.60:::::::*
cpe:2.3:a:google:chrome:22.0.1229.62:::::::*
cpe:2.3:a:google:chrome:22.0.1229.25:::::::*
cpe:2.3:a:google:chrome:22.0.1229.51:::::::*
cpe:2.3:a:google:chrome:22.0.1229.0:::::::*
cpe:2.3:a:google:chrome:22.0.1229.1:::::::*
cpe:2.3:a:google:chrome:22.0.1229.7:::::::*
cpe:2.3:a:google:chrome:22.0.1229.17:::::::*
cpe:2.3:a:google:chrome:22.0.1229.20:::::::*
cpe:2.3:a:google:chrome:22.0.1229.26:::::::*
cpe:2.3:a:google:chrome:22.0.1229.65:::::::*
cpe:2.3:a:google:chrome:22.0.1229.8:::::::*
cpe:2.3:a:google:chrome:22.0.1229.59:::::::*
cpe:2.3:a:google:chrome:22.0.1229.37:::::::*
cpe:2.3:a:google:chrome:22.0.1229.52:::::::*
cpe:2.3:a:google:chrome:22.0.1229.49:::::::*
cpe:2.3:a:google:chrome:22.0.1229.55:::::::*
cpe:2.3:a:google:chrome:22.0.1229.64:::::::*
cpe:2.3:a:google:chrome:22.0.1229.27:::::::*
cpe:2.3:a:google:chrome:22.0.1229.28:::::::*
cpe:2.3:a:google:chrome:22.0.1229.76:::::::*
cpe:2.3:a:google:chrome:22.0.1229.56:::::::*
cpe:2.3:a:google:chrome:22.0.1229.48:::::::*
cpe:2.3:a:google:chrome:22.0.1229.67:::::::*
cpe:2.3:a:google:chrome:22.0.1229.29:::::::*
cpe:2.3:a:google:chrome:22.0.1229.14:::::::*
cpe:2.3:a:google:chrome:22.0.1229.79:::::::*
cpe:2.3:a:google:chrome:22.0.1229.11:::::::*
cpe:2.3:a:apple:webkit::::::::
cpe:2.3:a:google:chrome:22.0.1229.6:::::::*
cpe:2.3:a:google:chrome:22.0.1229.24:::::::*
cpe:2.3:a:google:chrome:22.0.1229.3:::::::*
cpe:2.3:a:google:chrome::::::::		22.0.1229.96
cpe:2.3:a:google:chrome:22.0.1229.94:::::::*
cpe:2.3:a:google:chrome:22.0.1229.58:::::::*
cpe:2.3:a:google:chrome:22.0.1229.39:::::::*
cpe:2.3:a:google:chrome:22.0.1229.53:::::::*
cpe:2.3:a:google:chrome:22.0.1229.91:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:apple:safari:5.1.7:::::::*
cpe:2.3:a:apple:webkit::::::::

Related information, measures and tools

No	URL	タグ
1	http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html	Exploit
2	http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html	Exploit
3	https://bugs.webkit.org/show_bug.cgi?id=92692	Exploit
4	https://bugs.webkit.org/show_bug.cgi?id=92692	Exploit
5	https://exchange.xforce.ibmcloud.com/vulnerabilities/80072
6	https://exchange.xforce.ibmcloud.com/vulnerabilities/80072

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:google:chrome:22.0.1229.23:::::::*
cpe:2.3:a:google:chrome:22.0.1229.63:::::::*
cpe:2.3:a:google:chrome:22.0.1229.18:::::::*
cpe:2.3:a:google:chrome:22.0.1229.33:::::::*
cpe:2.3:a:google:chrome:22.0.1229.9:::::::*
cpe:2.3:a:google:chrome:22.0.1229.57:::::::*
cpe:2.3:a:google:chrome:22.0.1229.32:::::::*
cpe:2.3:a:google:chrome:22.0.1229.54:::::::*
cpe:2.3:a:google:chrome:22.0.1229.16:::::::*
cpe:2.3:a:google:chrome:22.0.1229.4:::::::*
cpe:2.3:a:google:chrome:22.0.1229.21:::::::*
cpe:2.3:a:google:chrome:22.0.1229.95:::::::*
cpe:2.3:a:google:chrome:22.0.1229.78:::::::*
cpe:2.3:a:google:chrome:22.0.1229.12:::::::*
cpe:2.3:a:google:chrome:22.0.1229.31:::::::*
cpe:2.3:a:google:chrome:22.0.1229.92:::::::*
cpe:2.3:a:google:chrome:22.0.1229.89:::::::*
cpe:2.3:a:google:chrome:22.0.1229.10:::::::*
cpe:2.3:a:google:chrome:22.0.1229.2:::::::*
cpe:2.3:a:google:chrome:22.0.1229.22:::::::*
cpe:2.3:a:google:chrome:22.0.1229.35:::::::*
cpe:2.3:a:google:chrome:22.0.1229.50:::::::*
cpe:2.3:a:google:chrome:22.0.1229.36:::::::*
cpe:2.3:a:google:chrome:22.0.1229.60:::::::*
cpe:2.3:a:google:chrome:22.0.1229.62:::::::*
cpe:2.3:a:google:chrome:22.0.1229.25:::::::*
cpe:2.3:a:google:chrome:22.0.1229.51:::::::*
cpe:2.3:a:google:chrome:22.0.1229.0:::::::*
cpe:2.3:a:google:chrome:22.0.1229.1:::::::*
cpe:2.3:a:google:chrome:22.0.1229.7:::::::*
cpe:2.3:a:google:chrome:22.0.1229.17:::::::*
cpe:2.3:a:google:chrome:22.0.1229.20:::::::*
cpe:2.3:a:google:chrome:22.0.1229.26:::::::*
cpe:2.3:a:google:chrome:22.0.1229.65:::::::*
cpe:2.3:a:google:chrome:22.0.1229.8:::::::*
cpe:2.3:a:google:chrome:22.0.1229.59:::::::*
cpe:2.3:a:google:chrome:22.0.1229.37:::::::*
cpe:2.3:a:google:chrome:22.0.1229.52:::::::*
cpe:2.3:a:google:chrome:22.0.1229.49:::::::*
cpe:2.3:a:google:chrome:22.0.1229.55:::::::*
cpe:2.3:a:google:chrome:22.0.1229.64:::::::*
cpe:2.3:a:google:chrome:22.0.1229.27:::::::*
cpe:2.3:a:google:chrome:22.0.1229.28:::::::*
cpe:2.3:a:google:chrome:22.0.1229.76:::::::*
cpe:2.3:a:google:chrome:22.0.1229.56:::::::*
cpe:2.3:a:google:chrome:22.0.1229.48:::::::*
cpe:2.3:a:google:chrome:22.0.1229.67:::::::*
cpe:2.3:a:google:chrome:22.0.1229.29:::::::*
cpe:2.3:a:google:chrome:22.0.1229.14:::::::*
cpe:2.3:a:google:chrome:22.0.1229.79:::::::*
cpe:2.3:a:google:chrome:22.0.1229.11:::::::*
cpe:2.3:a:apple:webkit::::::::
cpe:2.3:a:google:chrome:22.0.1229.6:::::::*
cpe:2.3:a:google:chrome:22.0.1229.24:::::::*
cpe:2.3:a:google:chrome:22.0.1229.3:::::::*
cpe:2.3:a:google:chrome::::::::		22.0.1229.96
cpe:2.3:a:google:chrome:22.0.1229.94:::::::*
cpe:2.3:a:google:chrome:22.0.1229.58:::::::*
cpe:2.3:a:google:chrome:22.0.1229.39:::::::*
cpe:2.3:a:google:chrome:22.0.1229.53:::::::*
cpe:2.3:a:google:chrome:22.0.1229.91:::::::*