Rosetta-Flash JSONP Vulnerability in hapi

🗓️ 31 Aug 2020 22:45:35Reported by GitHub Advisory DatabaseType

hapi vulnerable to rosetta-flash attack, update to version 6.1.1 or later, or use callback prepending solution

Reporter	Title	Published	Views	Family All 63
0day.today	Flash "Rosetta" JSONP GET/POST Response Disclosure Exploit	13 Jul 201400:00	–	zdt
Tenable Nessus	Flash Player < 14.0.0.145 Multiple Vulnerabilities (APSB14-17)	8 Jul 201400:00	–	nessus
Tenable Nessus	Adobe AIR < 14.0.0.137 Multiple Vulnerabilities (APSB14-17)	8 Jul 201400:00	–	nessus
Tenable Nessus	Adobe AIR <= AIR 14.0.0.110 Multiple Vulnerabilities (APSB14-17)	8 Jul 201400:00	–	nessus
Tenable Nessus	Flash Player <= 14.0.0.125 Multiple Vulnerabilities (APSB14-17)	8 Jul 201400:00	–	nessus
Tenable Nessus	GLSA-201407-02 : Adobe Flash Player: Multiple vulnerabilities	10 Jul 201400:00	–	nessus
Tenable Nessus	Adobe AIR for Mac <= 14.0.0.110 Multiple Vulnerabilities (APSB14-17)	8 Jul 201400:00	–	nessus
Tenable Nessus	Flash Player for Mac <= 14.0.0.125 Multiple Vulnerabilities (APSB14-17)	8 Jul 201400:00	–	nessus
Tenable Nessus	openSUSE Security Update : flash-player (openSUSE-SU-2014:0903-1)	17 Jul 201400:00	–	nessus
Tenable Nessus	RHEL 5 / 6 : flash-plugin (RHSA-2014:0860)	10 Jul 201400:00	–	nessus

Vulners

Node

hapi hapiRange<6.1.0npm

Source	Link
github	www.github.com/spumko/hapi/pull/1766
github	www.github.com/patrickkettner
npmjs	www.npmjs.com/advisories/12
miki	www.miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-4671
helpx	www.helpx.adobe.com/security/products/flash-player/apsb14-17.html
rhn	www.rhn.redhat.com/errata/RHSA-2014-0860.html
secunia	www.secunia.com/advisories/59774
secunia	www.secunia.com/advisories/59837
security	www.security.gentoo.org/glsa/glsa-201407-02.xml

14 Apr 2023 19:20Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

EPSS0.35827