PT-2017-1274 · Google+5 · Google Chrome+5
Publicado
2017-01-25
·
Atualizado
2024-06-15
·
CVE-2017-5011
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 56.0.2924.76
Opera versions prior to 56.0.2924.76
Description
The issue is related to insufficient sanitization of DevTools URLs, which allowed a remote attacker who convinced a user to install a malicious extension to read filesystem contents via a crafted HTML page. This could be achieved by exploiting the lack of protection for service data.
Recommendations
For Google Chrome versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later.
For Opera versions prior to 56.0.2924.76, update to version 56.0.2924.76 or later.
As a temporary workaround, consider disabling the installation of extensions until a patch is available.
Restrict access to the DevTools module to minimize the risk of exploitation.
Avoid using crafted HTML pages in the affected browser versions until the issue is resolved.
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse
Ubuntu