PT-2017-14065 · Opera+4 · Opera+4
Jun Kokatsu
·
Publicado
2017-12-06
·
Atualizado
2024-06-15
·
CVE-2017-15419
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 63.0.3239.84
Opera (affected versions not specified)
Description
The issue is related to insufficient policy enforcement in the Resource Timing API, allowing a remote attacker to infer browsing history. This can be achieved by triggering a leaked cross-origin URL via a crafted HTML page. The attacker can exploit this to obtain the browsing history of the victim.
Recommendations
For Google Chrome versions prior to 63.0.3239.84, update to version 63.0.3239.84 or later to resolve the issue.
For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Google Chrome
Opera
Red Hat
Suse