CVE-2012-6636

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-6636
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://50.56.33.56/blog/?p=314
http://developer.android.com/reference/android/os/Build.VERSION_CODES.html#JELLY_BEAN_MR1
http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29
http://jvn.jp/en/jp/JVN62161191/index.html
http://openwall.com/lists/oss-security/2014/02/07/9
http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf Exploit
http://www.internetsociety.org/ndss2014/programme#session3
https://support.lenovo.com/us/en/product_security/len_6421
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:google:android_api:*:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:1.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:2.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:3.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:4.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:5.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:6.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:7.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:8.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:9.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:10.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:11.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:12.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:13.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:14.0:*:*:*:*:*:*:*
cpe:2.3:a:google:android_api:15.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:13

Type Values Removed Values Added
References
  • {'url': 'http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object,%20java.lang.String%29', 'name': 'http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object,%20java.lang.String%29', 'tags': [], 'refsource': 'CONFIRM'}
  • () http://developer.android.com/reference/android/webkit/WebView.html#addJavascriptInterface%28java.lang.Object%2C%20java.lang.String%29 -
Information

Published : 2014-03-03 04:50

Updated : 2023-12-10 11:31

NVD link : CVE-2012-6636

Mitre link : CVE-2012-6636

CVE.ORG link : CVE-2012-6636

JSON object : View

Products Affected

google

  • android_api
CWE
CWE-264

Permissions, Privileges, and Access Controls