Lucene search

[email protected]CVE-2019-3562

HistoryApr 29, 2019 - 4:29 p.m.

CVE-2019-3562

2019-04-2916:29:00

CWE-74

CWE-79

[email protected]

web.nvd.nist.gov

nvd

cve-2019-3562

web security

remote injection

html code

ui spoofing

code execution

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

38.1%

JSON

A remote web page could inject arbitrary HTML code into the Oculus Browser UI, allowing an attacker to spoof UI and potentially execute code. This affects the Oculus Browser starting from version 5.2.7 until 5.7.11.

Affected configurations

NVD

Node

oculusoculus_browserRange5.2.7–5.7.11

VendorProductVersionCPE
oculusoculus_browsercpe:/a:oculus:oculus_browser::::

Vendor	Product	Version	CPE
oculus	oculus_browser		cpe:/a:oculus:oculus_browser::::

CNA Affected

[
  {
    "product": "Oculus Browser",
    "vendor": "Oculus",
    "versions": [
      {
        "status": "affected",
        "version": "5.7.11"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "5.2.7",
        "versionType": "custom"
      },
      {
        "lessThan": "5.2.7",
        "status": "unaffected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.facebook.com/security/advisories/cve-2019-3562

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

38.1%

JSON

Related for CVE-2019-3562

nvd1 prion1 cvelist1