PT-2014-4188 · Maxthon · Maxthon Cloud Browser

Published 2014-12-25 · Updated 2014-12-29 · CVE-2014-1449

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Maxthon Cloud Browser versions prior to 4.1.6.2000

Description The issue allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API. This can be achieved by utilizing specifically designed JavaScript code.

Recommendations For versions prior to 4.1.6.2000, update to version 4.1.6.2000 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2014-1449

Affected Products

Maxthon Cloud Browser

References · 3

• 🔥 http://browser-shredders.blogspot.com/2014/01/cve-2014-1449-maxthon-cloud-browser-for.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-1449 · Security Note
• http://maxthon.com/android/changelog · Vendor Advisory