PT-2014-1374 · Google+2 · Google Chrome+2
Publicado
2014-08-26
·
Atualizado
2024-06-15
·
CVE-2014-3172
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 37.0.2062.94
Description
The issue exists due to the lack of URL validation in the Debugger extension API before an attach operation. This allows remote attackers to bypass access limitations by using an extension with a restricted URL, such as a
chrome:// URL.Recommendations
For versions prior to 37.0.2062.94, update to version 37.0.2062.94 or later to resolve the issue. As a temporary workaround, consider restricting access to the
debugger api.cc module to minimize the risk of exploitation. Avoid using restricted URLs, such as chrome:// URLs, in extensions until the issue is resolved.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Suse