CVE-2011-4692
published 2011-12-07CVE-2011-4692: WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading…
PriorityP420medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
1.21%
65.3th percentile
WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it easier for remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, as demonstrated by visipisi.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | safari | <= 5.1.1 | — |
| chrome | <= 15 | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-c3h2-qw7j-hgxw: WebKit, as used in Apple Safari 5
ghsa_unreviewed·2022-05-17
CVE-2011-4692 [MEDIUM] GHSA-c3h2-qw7j-hgxw: WebKit, as used in Apple Safari 5
WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it easier for remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, as demonstrated by visipisi.
OSV
CVE-2011-4692: WebKit, as used in Apple Safari 5
osv·2011-12-07·CVSS 5.0
CVE-2011-4692 [MEDIUM] CVE-2011-4692: WebKit, as used in Apple Safari 5
WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it easier for remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, as demonstrated by visipisi.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://lcamtuf.coredump.cx/cachetime/http://oxplot.github.com/visipisi/visipisi.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14098http://lcamtuf.coredump.cx/cachetime/http://oxplot.github.com/visipisi/visipisi.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14098
2011-12-07
Published