CVE-2017-5928

The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now "Time to Tick" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code.

CVSS v3 3.7 LOW
CVSS v2.0 4.3 MEDIUM

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf	Technical Description
http://www.securityfocus.com/bid/97036	Third Party Advisory VDB Entry
https://www.vusec.net/projects/anc	Third Party Advisory
http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf	Technical Description
http://www.securityfocus.com/bid/97036	Third Party Advisory VDB Entry
https://www.vusec.net/projects/anc	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:w3:high_resolution_time_api:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-02-27 07:59

Updated : 2025-04-20 01:37

NVD link : CVE-2017-5928

Mitre link : CVE-2017-5928

CVE.ORG link : CVE-2017-5928

JSON object : View

Products Affected

w3

high_resolution_time_api

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-5928", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2017-02-27T07:59:00.270", "references": [{"url": "http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf", "tags": ["Technical Description"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/97036", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://www.vusec.net/projects/anc", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.cs.vu.nl/~herbertb/download/papers/anc_ndss17.pdf", "tags": ["Technical Description"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/97036", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.vusec.net/projects/anc", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a performance.now \"Time to Tick\" approach even with the https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 protection mechanism in place, which makes it easier for remote attackers to conduct AnC attacks via crafted JavaScript code."}, {"lang": "es", "value": "La API W3C High Resolution Time, tal como se implementa en varios navegadores web, no considera que los tiempos de referencia de memoria puedan medirse por un enfoque performance.now \"Time to Tick\" incluso con el mecanismo de protecci\u00f3n https://bugzilla.mozilla.org/show_bug.cgi?id=1167489#c9 en su lugar, lo que facilita a atacantes remotos llevar a cabo ataques AnC a trav\u00e9s de c\u00f3digo JavaScript manipulado."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:w3:high_resolution_time_api:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BA6BB7F-670D-408A-9865-071078594BD0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}