CVE-2012-6636 Code injection in n/a
Remote attackers can execute arbitrary Java methods via crafted JavaScript in WebView components on Android API levels 16 and earlier.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-6636?
CVE-2012-6636 is a medium-severity code injection vulnerability in n/a, published on 3 Mar 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection API within crafted JavaScript code that is loaded into the WebView component in an application targeted to API level 16 or earlier, a related issue to CVE-2013-4710.
Weakness: CWE-264
Which versions are affected by CVE-2012-6636?
It affects 1 product.
Products include Google Android Api.
How do I fix CVE-2012-6636?
No fix has been published for CVE-2012-6636 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2012-6636 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-6636 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Sources
Also known as GHSA-9qcw-937q-52w8, UBUNTU-CVE-2012-6636.