PRIOn knowledge basePRION:CVE-2015-1254

HistoryMay 20, 2015 - 10:59 a.m.

Design/Logic Flaw

2015-05-2010:59:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

74.8%

JSON

core/dom/Document.cpp in Blink, as used in Google Chrome before 43.0.2357.65, enables the inheritance of the designMode attribute, which allows remote attackers to bypass the Same Origin Policy by leveraging the availability of editing.

CPENameOperatorVersion
debian_linuxeq8.0
chromele42.0.2311.152

CPE	Name	Operator	Version
	debian_linux	eq	8.0
	chrome	le	42.0.2311.152

References

lists.opensuse.org/opensuse-updates/2015-05/msg00091.html

lists.opensuse.org/opensuse-updates/2015-11/msg00015.html

www.debian.org/security/2015/dsa-3267

www.securityfocus.com/bid/74723

www.securitytracker.com/id/1032375

code.google.com/p/chromium/issues/detail?id=444927

googlechromereleases.blogspot.com/2015/05/stable-channel-update_19.html

security.gentoo.org/glsa/201506-04

src.chromium.org/viewvc/blink?revision=192658&view=revision

6.6 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

74.8%

JSON

Related for PRION:CVE-2015-1254