PT-2009-4781 · Google · Google Chrome

Publicado 2009-07-07 · Atualizado 2018-10-10 · CVE-2009-2352

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions 1.0.154.48 and earlier Google Chrome version 2.0.172.28 Google Chrome version 2.0.172.37 Google Chrome version 3.0.193.2 Beta

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to injecting a Refresh header or specifying the content of a Refresh header in HTTP responses. This is due to the failure to block javascript: URIs in Refresh headers.

Recommendations For Google Chrome versions 1.0.154.48 and earlier, update to a version later than 1.0.154.48 to resolve the issue. For Google Chrome version 2.0.172.28, update to a version later than 2.0.172.28 to resolve the issue. For Google Chrome version 2.0.172.37, update to a version later than 2.0.172.37 to resolve the issue. For Google Chrome version 3.0.193.2 Beta, update to a version later than 3.0.193.2 Beta to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-2352

Produtos afetados

Google Chrome

Referências · 7

• 🔥 http://securityfocus.com/bid/35572 · Exploit
• 🔥 https://exploit-db.com/exploits/33064 · Exploit
• http://websecurity.com.ua/3275 · Nota
• http://securityfocus.com/archive/1/504718/100/0/threaded · Nota
• http://websecurity.com.ua/3386 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2352 · Nota de Segurança
• http://securityfocus.com/archive/1/504723/100/0/threaded · Nota