CVE-2010-3934
The browser in Research In Motion (RIM) BlackBerry Device Software 5.0.0.593 Platform 5.1.0.147 on the BlackBerry 9700 does not properly restrict cross-domain execution of JavaScript, which allows remote attackers to bypass the Same Origin Policy via…
Does this matter?
Lower severity and a low EPSS score (2.67%). Track it; it rarely justifies an emergency change on its own.
Description
The browser in Research In Motion (RIM) BlackBerry Device Software 5.0.0.593 Platform 5.1.0.147 on the BlackBerry 9700 does not properly restrict cross-domain execution of JavaScript, which allows remote attackers to bypass the Same Origin Policy via vectors related to a window.open call and an IFRAME element. NOTE: some of these details are obtained from third party information.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.67% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- rim/blackberry device software
- Source
- cve@mitre.org
References
- http://packetstormsecurity.org/1009-exploits/blackberry-crossorigin.txtExploit
- http://secunia.com/advisories/41536Vendor Advisory
- http://securitytracker.com/id?1024506
- http://packetstormsecurity.org/1009-exploits/blackberry-crossorigin.txtExploit
- http://secunia.com/advisories/41536Vendor Advisory
- http://securitytracker.com/id?1024506
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.