CVE-2014-6392: XSS
DISPUTED Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content's origin is a sandbox domain.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-6392?
CVE-2014-6392 is a disputed cross-site scripting (XSS) vulnerability that may allow for arbitrary script injection.
How do I fix CVE-2014-6392?
To remediate CVE-2014-6392, it is recommended to update the Facebook app to a version later than 14.0 or the Facebook Messenger app to a version beyond 10.0.
What types of software are affected by CVE-2014-6392?
CVE-2014-6392 affects the Facebook app version 14.0 and the Facebook Messenger app version 10.0 on iOS devices.
How can CVE-2014-6392 be exploited?
CVE-2014-6392 can be exploited by remote attackers who inject scripts through crafted filename extensions that are mishandled during MIME sniffing.
Are there any known mitigations for CVE-2014-6392?
There are no specific mitigations published for CVE-2014-6392 other than updating to the latest versions of the affected apps.