NVD

Id
47312  
Name
CVE-2012-6636  
Description
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-03-02  
Modified Date
2016-06-01  
Seq
2012-6636  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
236504 47312 CVE-2012-6636 http://50.56.33.56/blog/?p=314  View
236505 47312 CVE-2012-6636 http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1  View
236506 47312 CVE-2012-6636 http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object,%20java.lang.String%29  View
236507 47312 CVE-2012-6636 [oss-security] 20140207 Re: CVE request: multiple issues in Apache Cordova/PhoneGap  View
236508 47312 CVE-2012-6636 http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf  View
236509 47312 CVE-2012-6636 http://www.internetsociety.org/ndss2014/programme#session3  View
236510 47312 CVE-2012-6636 https://support.lenovo.com/us/en/product_security/len_6421  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12674 JVNDB-2014-001549 Android API における Java オブジェクトの任意のメソッドを実行される脆弱性 Android API は、WebView.addJavascriptInterface メソッドを適切に制限しないため、Java オブジェクトの任意のメソッドを実行される脆弱性が存在します。 CVE-2012-6636 59874 CVE-2012-6636 47312 6.8 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001549.html 2014-02-07 2014-03-04 View