CVE-2017-17859
Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive i…
Published 8 y ago · modified 4 mo ago · JSON
Summary
Samsung Internet Browser 6.2.01.12 allows remote attackers to bypass the Same Origin Policy, and conduct UXSS attacks to obtain sensitive information, via vectors involving an IFRAME element inside XSLT data in one part of an MHTML file. Specifically, JavaScript code in another part of this MHTML file does not have a document.domain value corresponding to the domain that is hosting the MHTML file, but instead has a document.domain value corresponding to an arbitrary URL within the content of the MHTML file.
Exploit prediction (EPSS)
0.94% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- poctestblog.blogspot.com /2017/12/samsung-internet-browser-sop-bypassuxss.html · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-17859
- NVD: CVE-2017-17859
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.