CVE-2015-2745

Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.mozilla.org/security/announce/2015/mfsa2015-73.html	Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1101158
https://github.com/mozilla-b2g/gaia/commit/0f72a8c31df9f3d8f609a7c58ca91139051d44eb

Configurations

Configuration 1 (hide)

cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-08-08 00:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-2745

Mitre link : CVE-2015-2745

CVE.ORG link : CVE-2015-2745

JSON object : View

Products Affected

mozilla

firefox_os

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2015-2745", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-08-08T00:59:02.097", "references": [{"url": "http://www.mozilla.org/security/announce/2015/mfsa2015-73.html", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1101158", "source": "security@mozilla.org"}, {"url": "https://github.com/mozilla-b2g/gaia/commit/0f72a8c31df9f3d8f609a7c58ca91139051d44eb", "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Search app in Gaia in Mozilla Firefox OS before 2.2 allow remote attackers to inject arbitrary HTML via the (1) name or (2) title field in card content associated with a search link that is mishandled after a HOME button press or a Show Windows action, as demonstrated by embedding an arbitrary application or spoofing the account-creation page."}, {"lang": "es", "value": "Vulnerabilidades m\u00faltiples de XSS en la aplicaci\u00f3n Search en Gaia en Mozilla Firefox OS en versiones anteriores a 2.2, permite a atacantes remotos inyectar HTML arbitrario a trav\u00e9s del campo (1) name o (2) title en el contenido de tarjeta asociado a un enlace de b\u00fasqueda que no es manejado correctamente despu\u00e9s de que se pulse el bot\u00f3n HOME o de una acci\u00f3n Show Windows, seg\u00fan lo demostrado incrustando una aplicaci\u00f3n arbitraria o suplantando la p\u00e1gina account-creation."}], "lastModified": "2015-08-10T12:51:41.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:mozilla:firefox_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3EF192A-A8DF-404D-8413-77A717EA0595", "versionEndIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}