NVD

Id
33661  
Name
CVE-2014-6041  
Description
The Android WebView in Android before 4.4 allows remote attackers to bypass the Same Origin Policy via a crafted attribute containing a u0000 character, as demonstrated by an onclick="window.open("u0000javascript: sequence to the Android Browser application 4.2.1 or a third-party web browser.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-09-02  
Modified Date
2017-01-06  
Seq
2014-6041  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
174859 33661 CVE-2014-6041 http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html  View
174860 33661 CVE-2014-6041 69548  View
174861 33661 CVE-2014-6041 google-android-cve20146041-sec-bypass(95693)  View
174862 33661 CVE-2014-6041 https://android.googlesource.com/platform/external/webkit/+/1368e05e8875f00e8d2529fe6050d08b55ea4d87  View
174863 33661 CVE-2014-6041 https://android.googlesource.com/platform/external/webkit/+/7e4405a7a12750ee27325f065b9825c25b40598c  View
174864 33661 CVE-2014-6041 https://community.rapid7.com/community/metasploit/blog/2014/09/15/major-android-bug-is-a-privacy-disaster-cve-2014-6041  View
174865 33661 CVE-2014-6041 https://news.ycombinator.com/item?id=8321185  View
174866 33661 CVE-2014-6041 https://news.ycombinator.com/item?id=8325807  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15142 JVNDB-2014-004017 Android の Android WebView における同一生成元ポリシーを回避される脆弱性 Android の Android WebView には、同一生成元ポリシーを回避される脆弱性が存在します。 CVE-2014-6041 73332 CVE-2014-6041 33661 5.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004017.html 2014-09-02 2014-10-06 View