NVD

Id
30278  
Name
CVE-2014-1701  
Description
The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-03-16  
Modified Date
2017-01-06  
Seq
2014-1701  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
160261 30278 CVE-2014-1701 http://googlechromereleases.blogspot.com/2014/03/stable-channel-update_11.html  View
160262 30278 CVE-2014-1701 openSUSE-SU-2014:0501  View
160263 30278 CVE-2014-1701 GLSA-201408-16  View
160264 30278 CVE-2014-1701 DSA-2883  View
160265 30278 CVE-2014-1701 1029914  View
160266 30278 CVE-2014-1701 https://code.google.com/p/chromium/issues/detail?id=342618  View
160267 30278 CVE-2014-1701 https://src.chromium.org/viewvc/blink?revision=166999&view=revision  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12811 JVNDB-2014-001686 Google Chrome で使用される Blink の bindings/scripts/code_generator_v8.pm における Universal XSS 攻撃を実行される脆弱性 Google Chrome で使用される Blink の bindings/scripts/code_generator_v8.pm 内の GenerateFunction 関数は、EventTarget::dispatchEvent 関数に対して特定のクロスオリジンの制限を実装しないため、Universal XSS (UXSS) 攻撃を実行される脆弱性が存在します。 CVE-2014-1701 68988 CVE-2014-1701 30278 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001686.html 2014-03-11 2014-03-18 View