NVD

Id
33908  
Name
CVE-2014-6392  
Description
** DISPUTED ** Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content"s origin is a sandbox domain.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-09-15  
Modified Date
2014-09-23  
Seq
2014-6392  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
175935 33908 CVE-2014-6392 20140902 Reflected XSS Attacks vulnerabilities used MIME Sniffing in Facebook Messenger and Facebook App for iOS.  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
15310 JVNDB-2014-004185 iOS 用 Facebook アプリおよび Facebook Messenger アプリにおけるクロスサイトスクリプティングの脆弱性 ** 未確定 ** 本件は、脆弱性として確定していません。 CVE-2014-6392 73684 CVE-2014-6392 33908 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-004185.html 2014-09-02 2015-10-21 View