Vulnerability Name:

CVE-2012-5851 (CCN-80072)

Assigned:2012-08-02
Published:2012-08-02
Updated:2017-08-29
Summary:html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.5 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
4.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:U/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Bypass Security
References:Source: MISC
Type: Exploit
http://blog.opensecurityresearch.com/2012/09/simple-cross-site-scripting-vector-that.html

Source: MITRE
Type: CNA
CVE-2012-5851

Source: CCN
Type: BID-56570
WebKit Cross Site Scripting Filter 'XSSAuditor.cpp' Security Bypass Vulnerability

Source: CCN
Type: WebKit Bugzilla: Bug 92692
WebKit XSS Auditor bypass

Source: CONFIRM
Type: Exploit
https://bugs.webkit.org/show_bug.cgi?id=92692

Source: XF
Type: UNKNOWN
webkit-webcore-sec-bypass(80072)

Source: XF
Type: UNKNOWN
webkit-webcore-sec-bypass(80072)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:apple:webkit:*:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.2:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.3:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.4:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.6:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.7:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.8:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.9:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.10:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.11:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.12:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.14:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.16:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.17:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.18:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.20:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.21:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.22:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.23:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.24:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.25:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.26:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.27:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.28:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.29:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.31:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.32:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.33:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.35:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.36:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.37:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.39:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.48:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.49:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.50:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.51:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.52:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.53:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.54:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.55:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.56:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.57:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.58:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.59:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.60:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.62:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.63:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.64:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.65:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.67:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.76:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.78:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.79:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.89:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.91:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.92:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.94:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.95:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version <= 22.0.1229.96)

    • Configuration 2:
  • cpe:/a:apple:safari:5.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:apple:webkit:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:apple:webkit:*:*:*:*:*:*:*:*
  • OR cpe:/a:apple:safari:5.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.92:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.94:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.95:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.96:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.63:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.64:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.65:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.67:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.58:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.59:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.60:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.62:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.76:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.78:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.21:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.22:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.18:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.20:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.16:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.17:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.12:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.14:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.29:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.31:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.27:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.28:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.25:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.26:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.23:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.24:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.49:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.48:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.39:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.37:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.36:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.35:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.33:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.32:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.57:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.56:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.55:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.54:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.53:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.52:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.51:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.50:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.9:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.7:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.8:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.4:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.6:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.2:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.3:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.0:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.1:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.11:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.10:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.91:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.79:*:*:*:*:*:*:*
  • OR cpe:/a:google:chrome:22.0.1229.89:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.precise:def:20125851000
    V
    		CVE-2012-5851 on Ubuntu 12.04 LTS (precise) - medium.
    2012-11-15
    oval:com.ubuntu.trusty:def:20125851000
    V
    		CVE-2012-5851 on Ubuntu 14.04 LTS (trusty) - medium.
    2012-11-15
    oval:com.ubuntu.xenial:def:20125851000
    V
    		CVE-2012-5851 on Ubuntu 16.04 LTS (xenial) - medium.
    2012-11-15
    oval:com.ubuntu.xenial:def:201258510000000
    V
    		CVE-2012-5851 on Ubuntu 16.04 LTS (xenial) - medium.
    2012-11-15
    BACK
    apple webkit *
    google chrome 22.0.1229.0
    google chrome 22.0.1229.1
    google chrome 22.0.1229.2
    google chrome 22.0.1229.3
    google chrome 22.0.1229.4
    google chrome 22.0.1229.6
    google chrome 22.0.1229.7
    google chrome 22.0.1229.8
    google chrome 22.0.1229.9
    google chrome 22.0.1229.10
    google chrome 22.0.1229.11
    google chrome 22.0.1229.12
    google chrome 22.0.1229.14
    google chrome 22.0.1229.16
    google chrome 22.0.1229.17
    google chrome 22.0.1229.18
    google chrome 22.0.1229.20
    google chrome 22.0.1229.21
    google chrome 22.0.1229.22
    google chrome 22.0.1229.23
    google chrome 22.0.1229.24
    google chrome 22.0.1229.25
    google chrome 22.0.1229.26
    google chrome 22.0.1229.27
    google chrome 22.0.1229.28
    google chrome 22.0.1229.29
    google chrome 22.0.1229.31
    google chrome 22.0.1229.32
    google chrome 22.0.1229.33
    google chrome 22.0.1229.35
    google chrome 22.0.1229.36
    google chrome 22.0.1229.37
    google chrome 22.0.1229.39
    google chrome 22.0.1229.48
    google chrome 22.0.1229.49
    google chrome 22.0.1229.50
    google chrome 22.0.1229.51
    google chrome 22.0.1229.52
    google chrome 22.0.1229.53
    google chrome 22.0.1229.54
    google chrome 22.0.1229.55
    google chrome 22.0.1229.56
    google chrome 22.0.1229.57
    google chrome 22.0.1229.58
    google chrome 22.0.1229.59
    google chrome 22.0.1229.60
    google chrome 22.0.1229.62
    google chrome 22.0.1229.63
    google chrome 22.0.1229.64
    google chrome 22.0.1229.65
    google chrome 22.0.1229.67
    google chrome 22.0.1229.76
    google chrome 22.0.1229.78
    google chrome 22.0.1229.79
    google chrome 22.0.1229.89
    google chrome 22.0.1229.91
    google chrome 22.0.1229.92
    google chrome 22.0.1229.94
    google chrome 22.0.1229.95
    google chrome *
    apple safari 5.1.7
    apple webkit *
    apple webkit *
    apple safari 5.1.7
    google chrome 22.0.1229.92
    google chrome 22.0.1229.94
    google chrome 22.0.1229.95
    google chrome 22.0.1229.96
    google chrome 22.0.1229.63
    google chrome 22.0.1229.64
    google chrome 22.0.1229.65
    google chrome 22.0.1229.67
    google chrome 22.0.1229.58
    google chrome 22.0.1229.59
    google chrome 22.0.1229.60
    google chrome 22.0.1229.62
    google chrome 22.0.1229.76
    google chrome 22.0.1229.78
    google chrome 22.0.1229.21
    google chrome 22.0.1229.22
    google chrome 22.0.1229.18
    google chrome 22.0.1229.20
    google chrome 22.0.1229.16
    google chrome 22.0.1229.17
    google chrome 22.0.1229.12
    google chrome 22.0.1229.14
    google chrome 22.0.1229.29
    google chrome 22.0.1229.31
    google chrome 22.0.1229.27
    google chrome 22.0.1229.28
    google chrome 22.0.1229.25
    google chrome 22.0.1229.26
    google chrome 22.0.1229.23
    google chrome 22.0.1229.24
    google chrome 22.0.1229.49
    google chrome 22.0.1229.48
    google chrome 22.0.1229.39
    google chrome 22.0.1229.37
    google chrome 22.0.1229.36
    google chrome 22.0.1229.35
    google chrome 22.0.1229.33
    google chrome 22.0.1229.32
    google chrome 22.0.1229.57
    google chrome 22.0.1229.56
    google chrome 22.0.1229.55
    google chrome 22.0.1229.54
    google chrome 22.0.1229.53
    google chrome 22.0.1229.52
    google chrome 22.0.1229.51
    google chrome 22.0.1229.50
    google chrome 22.0.1229.9
    google chrome 22.0.1229.7
    google chrome 22.0.1229.8
    google chrome 22.0.1229.4
    google chrome 22.0.1229.6
    google chrome 22.0.1229.2
    google chrome 22.0.1229.3
    google chrome 22.0.1229.0
    google chrome 22.0.1229.1
    google chrome 22.0.1229.11
    google chrome 22.0.1229.10
    google chrome 22.0.1229.91
    google chrome 22.0.1229.79
    google chrome 22.0.1229.89