Lucene search

[email protected]NVD:CVE-2014-1701

HistoryMar 16, 2014 - 2:06 p.m.

CVE-2014-1701

2014-03-1614:06:45

CWE-79

[email protected]

web.nvd.nist.gov

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.3 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

JSON

The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.

Affected configurations

NVD

Node

googlechromeRange≤33.0.1750.146

googlechromeMatch33.0.1750.0

googlechromeMatch33.0.1750.1

googlechromeMatch33.0.1750.2

googlechromeMatch33.0.1750.3

googlechromeMatch33.0.1750.4

googlechromeMatch33.0.1750.5

googlechromeMatch33.0.1750.6

googlechromeMatch33.0.1750.7

googlechromeMatch33.0.1750.8

googlechromeMatch33.0.1750.9

googlechromeMatch33.0.1750.10

googlechromeMatch33.0.1750.11

googlechromeMatch33.0.1750.12

googlechromeMatch33.0.1750.13

googlechromeMatch33.0.1750.14

googlechromeMatch33.0.1750.15

googlechromeMatch33.0.1750.16

googlechromeMatch33.0.1750.18

googlechromeMatch33.0.1750.19

googlechromeMatch33.0.1750.20

googlechromeMatch33.0.1750.21

googlechromeMatch33.0.1750.22

googlechromeMatch33.0.1750.23

googlechromeMatch33.0.1750.24

googlechromeMatch33.0.1750.25

googlechromeMatch33.0.1750.26

googlechromeMatch33.0.1750.27

googlechromeMatch33.0.1750.28

googlechromeMatch33.0.1750.29

googlechromeMatch33.0.1750.30

googlechromeMatch33.0.1750.31

googlechromeMatch33.0.1750.34

googlechromeMatch33.0.1750.35

googlechromeMatch33.0.1750.36

googlechromeMatch33.0.1750.37

googlechromeMatch33.0.1750.38

googlechromeMatch33.0.1750.39

googlechromeMatch33.0.1750.40

googlechromeMatch33.0.1750.41

googlechromeMatch33.0.1750.42

googlechromeMatch33.0.1750.43

googlechromeMatch33.0.1750.44

googlechromeMatch33.0.1750.45

googlechromeMatch33.0.1750.46

googlechromeMatch33.0.1750.47

googlechromeMatch33.0.1750.48

googlechromeMatch33.0.1750.49

googlechromeMatch33.0.1750.50

googlechromeMatch33.0.1750.51

googlechromeMatch33.0.1750.52

googlechromeMatch33.0.1750.53

googlechromeMatch33.0.1750.54

googlechromeMatch33.0.1750.55

googlechromeMatch33.0.1750.56

googlechromeMatch33.0.1750.57

googlechromeMatch33.0.1750.58

googlechromeMatch33.0.1750.59

googlechromeMatch33.0.1750.60

googlechromeMatch33.0.1750.61

googlechromeMatch33.0.1750.62

googlechromeMatch33.0.1750.63

googlechromeMatch33.0.1750.64

googlechromeMatch33.0.1750.65

googlechromeMatch33.0.1750.66

googlechromeMatch33.0.1750.67

googlechromeMatch33.0.1750.68

googlechromeMatch33.0.1750.69

googlechromeMatch33.0.1750.70

googlechromeMatch33.0.1750.71

googlechromeMatch33.0.1750.73

googlechromeMatch33.0.1750.74

googlechromeMatch33.0.1750.75

googlechromeMatch33.0.1750.76

googlechromeMatch33.0.1750.77

googlechromeMatch33.0.1750.79

googlechromeMatch33.0.1750.80

googlechromeMatch33.0.1750.81

googlechromeMatch33.0.1750.82

googlechromeMatch33.0.1750.83

googlechromeMatch33.0.1750.85

googlechromeMatch33.0.1750.88

googlechromeMatch33.0.1750.89

googlechromeMatch33.0.1750.90

googlechromeMatch33.0.1750.91

googlechromeMatch33.0.1750.92

googlechromeMatch33.0.1750.93

googlechromeMatch33.0.1750.104

googlechromeMatch33.0.1750.106

googlechromeMatch33.0.1750.107

googlechromeMatch33.0.1750.108

googlechromeMatch33.0.1750.109

googlechromeMatch33.0.1750.110

googlechromeMatch33.0.1750.111

googlechromeMatch33.0.1750.112

googlechromeMatch33.0.1750.113

googlechromeMatch33.0.1750.115

googlechromeMatch33.0.1750.116

googlechromeMatch33.0.1750.117

googlechromeMatch33.0.1750.124

googlechromeMatch33.0.1750.125

googlechromeMatch33.0.1750.126

googlechromeMatch33.0.1750.132

googlechromeMatch33.0.1750.133

googlechromeMatch33.0.1750.135

googlechromeMatch33.0.1750.136

googlechromeMatch33.0.1750.144

References

googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html

lists.opensuse.org/opensuse-security-announce/2014-04/msg00008.html

security.gentoo.org/glsa/glsa-201408-16.xml

www.debian.org/security/2014/dsa-2883

www.securitytracker.com/id/1029914

code.google.com/p/chromium/issues/detail?id=342618

src.chromium.org/viewvc/blink?revision=166999&view=revision

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.3 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.5%

JSON

Related for NVD:CVE-2014-1701

cve1 cvelist1 ubuntucve1 debiancve1 prion1 threatpost1 nessus7 openvas9 chrome1 freebsd1 mageia1 suse1 securityvulns2 debian2 osv1 gentoo1