CVE-2012-4009: Code Injection
Published Aug 31, 2012
·Updated
The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.
Affected Software
1 affected component
Cybozu Cybozu Live Android<=1.0.4
Event History
Aug 31, 2012
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4009?
CVE-2012-4009 is rated as a high severity vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2012-4009?
To mitigate CVE-2012-4009, update the Cybozu Live application to version 1.0.5 or later.
3
What types of attacks can exploit CVE-2012-4009?
CVE-2012-4009 can be exploited by attackers using crafted applications to execute arbitrary JavaScript code.
4
What versions of the Cybozu Live application are affected by CVE-2012-4009?
CVE-2012-4009 affects Cybozu Live versions up to and including 1.0.4.
5
What kind of sensitive information can be compromised due to CVE-2012-4009?
CVE-2012-4009 allows attackers to obtain sensitive information from the device where the application is run.