CVE-2014-6392 Cross-site scripting in n/a
Remote attackers can inject scripts via crafted filenames in Facebook iOS apps, though exploitation requires user interaction with a warning.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2014-6392?
CVE-2014-6392 is a medium-severity cross-site scripting vulnerability in n/a, published on 15 Sep 2014. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content's origin is a sandbox domain
Weakness: CWE-79
Which versions are affected by CVE-2014-6392?
It affects 2 products.
Products include Facebook Facebook, Facebook Facebook Messenger.
How do I fix CVE-2014-6392?
No fix has been published for CVE-2014-6392 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2014-6392 being exploited?
There is no known exploitation of CVE-2014-6392 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-gr4p-p93w-7rc9.