« Volver al listado

CVE-2015-1275

Estado: ModificadaMedia (4.3)—

Vulnerabilidad de XSS en org/chromium/chrome/browser/UrlUtilities.java en Google Chrome en versiones anteriores a la 44.0.2403.89 en Android. Permite a atacantes remotos inyectar arbitrariamente código HTML o web script a través de una URL manipulada, como lo demuestra una alerta de salida (document.cookie);// substring, error conocido como 'Universal XSS (UXSS).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Google — ChromeOpensuse — Opensuse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-1275",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "chrome-cve-admin@google.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-07-23T00:59:05.100",
  "references": [
    {
      "url": "http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/75973",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1033031",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://code.google.com/p/chromium/issues/detail?id=462843",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://codereview.chromium.org/1059413004/",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "https://security.gentoo.org/glsa/201603-09",
      "source": "chrome-cve-admin@google.com"
    },
    {
      "url": "http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00038.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/75973",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1033031",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://code.google.com/p/chromium/issues/detail?id=462843",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://codereview.chromium.org/1059413004/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201603-09",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in org/chromium/chrome/browser/UrlUtilities.java in Google Chrome before 44.0.2403.89 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted intent: URL, as demonstrated by a trailing alert(document.cookie);// substring, aka \"Universal XSS (UXSS).\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en org/chromium/chrome/browser/UrlUtilities.java en Google Chrome en versiones anteriores a la 44.0.2403.89 en Android. Permite a atacantes remotos inyectar arbitrariamente código HTML o web script a través de una URL manipulada, como lo demuestra una alerta de salida (document.cookie);// substring, error conocido como 'Universal XSS (UXSS)."
    }
  ],
  "lastModified": "2026-06-17T00:22:05.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "03117DF1-3BEC-4B8D-AD63-DBBDB2126081"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CD601FD-6060-4CC5-81DA-BDDE41485613",
              "versionEndIncluding": "43.0.2357.134"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8255F035-04C8-4158-B301-82101711939C"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "chrome-cve-admin@google.com"
}