WebKit CVE-2013-1012 Unspecified Cross Site Scripting Vulnerability
BID:60361
Info
WebKit CVE-2013-1012 Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 60361 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-1012 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 05 2013 12:00AM |
| Updated: | Mar 19 2015 08:29AM |
| Credit: | Subodh Iyengar and Erling Ellingsen of Facebook |
| Vulnerable: |
WebKit Open Source Project WebKit 0 Apple Safari 6.0.4 Apple Safari 6.0.3 Apple Safari 6.0.2 Apple Safari 6.0.1 Apple Safari 5.0.6 Apple Safari 6.0.1 for Windows Apple Safari 6.0 for Windows Apple Safari 6.0 Apple Safari 5.1.7 for Windows Apple Safari 5.1.7 Apple Safari 5.1.5 for Windows Apple Safari 5.1.4 for Windows Apple Safari 5.1.4 Apple Safari 5.1.1 for Windows Apple Safari 5.1.1 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 6.1.3 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 for Developer Apple iOS 6 Beta 4 Apple iOS 6 |
| Not Vulnerable: |
Apple Safari 6.0.5 for Windows Apple Safari 6.0.5 Apple iOS 7 |
Discussion
WebKit CVE-2013-1012 Unspecified Cross Site Scripting Vulnerability
WebKit is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 60330 (Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities), but has been given its own record to better document it.
WebKit is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 60330 (Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities), but has been given its own record to better document it.
Exploit / POC
WebKit CVE-2013-1012 Unspecified Cross Site Scripting Vulnerability
To exploit this issue an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit this issue an attacker must entice an unsuspecting user to follow a malicious URI.