PT-2017-14952 · Samsung · Samsung Internet Browser

Dhiraj Mishra · Publicado 2017-12-21 · Atualizado 2018-01-09 · CVE-2017-17692

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Samsung Internet Browser version 5.4.02.3

Description The issue allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code. This is achieved by redirecting to a child tab and rewriting the innerHTML property.

Recommendations For Samsung Internet Browser version 5.4.02.3, consider disabling JavaScript execution in child tabs as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-17692

Produtos afetados

Samsung Internet Browser

Referências · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/samsung_browser_sop_bypass.rb · Exploit
• 🔥❌ https://github.com/lr3800/CVE-2017-17692 · Exploit, Deleted
• 🔥 https://exploit-db.com/exploits/43376 · Exploit
• 🔥 https://datarift.blogspot.tw/p/samsung-interent-browser-sop-bypass-cve.html · Exploit
• 🔥 https://datarift.blogspot.in/p/samsung-interent-browser-sop-bypass-cve.html · Exploit
• 🔥 http://packetstormsecurity.com/files/145510/Samsung-Internet-Browser-SOP-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-17692 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17692 · Nota de Segurança