PT-2016-3422 · Yandex · Yandex Browser

Publicado 2016-10-26 · Atualizado 2016-12-02 · CVE-2016-8502

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yandex Browser versions 15.12.0 through 16.2

Description The issue is related to the Anti-phishing function in Yandex Browser, which could be exploited by a remote attacker to brute-force passwords from important web resources using special JavaScript. This is due to errors in security settings, allowing a remote attacker to bypass existing security restrictions.

Recommendations For Yandex Browser versions 15.12.0 through 16.2, consider disabling the Anti-phishing function as a temporary workaround until a patch is available. Restrict access to sensitive web resources to minimize the risk of exploitation. Avoid using the browser for critical operations that involve sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2022-03565

CVE-2016-8502

Produtos afetados

Yandex Browser

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-8502 · Nota de Segurança
• https://bdu.fstec.ru/vul/2022-03565 · Nota de Segurança
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Nota
• http://securityfocus.com/bid/93923 · Nota
• https://osv.dev/vulnerability/CVE-2016-8502 · Aviso do Fabricante
• https://browser.yandex.com/security/changelogs · Aviso do Fabricante