CVE-2017-5928

{"id": "CVE-2017-5928", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2017-02-27T07:59:00.270", "references": [{"url": "http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/97036", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.vusec.net/projects/anc", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now \"Time to Tick\" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code."}, {"lang": "es", "value": "La API W3C High Resolution Time, tal como se implementa en varios navegadores web, no considera que los tiempos de referencia de memoria puedan medirse por un enfoque performance.now \"Time to Tick\" incluso con el mecanismo de protecci\u00f3n https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 en su lugar, lo que facilita a atacantes remotos llevar a cabo ataques AnC a trav\u00e9s de c\u00f3digo JavaScript manipulado."}], "lastModified": "2021-09-13T12:04:51.793", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:w3:high_resolution_time_api:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BA6BB7F-670D-408A-9865-071078594BD0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}