PT-2016-3424 · Yandex · Yandex Browser

Publicado 2016-10-26 · Atualizado 2016-12-02 · CVE-2016-8503

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yandex Browser versions 16.7 through 16.9

Description The issue is related to the Yandex Protect Anti-phishing warning in Yandex Browser, which could be exploited by a remote attacker to brute-force passwords from important web resources using special JavaScript. The vulnerability is associated with errors in security settings, allowing a remote attacker to bypass existing security restrictions.

Recommendations For Yandex Browser versions 16.7 through 16.9, consider disabling the Anti-phishing function as a temporary workaround until a patch is available. Restrict access to sensitive web resources to minimize the risk of exploitation. Avoid using the browser for critical operations that involve sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2022-03573

CVE-2016-8503

Produtos afetados

Yandex Browser

Referências · 6

• http://securityfocus.com/bid/93921 · Nota
• https://bdu.fstec.ru/vul/2022-03573 · Nota de Segurança
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Nota
• https://osv.dev/vulnerability/CVE-2016-8503 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-8503 · Nota de Segurança
• https://browser.yandex.com/security/changelogs · Aviso do Fabricante