PT-2017-3234 · Google+3 · Google Chrome+3
Publicado
2017-04-19
·
Atualizado
2024-06-15
·
CVE-2017-5069
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 58.0.3029.81 for Linux, Windows, and Mac
Google Chrome version prior to 58.0.3029.83 for Android
Description
The issue allows a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page, due to an incorrect MIME type of XSS-Protection reports in Blink. This can be exploited by a remote attacker using a specially formed HTML page to bypass CORS checks.
Recommendations
For Google Chrome versions prior to 58.0.3029.81 on Linux, Windows, and Mac, update to version 58.0.3029.81 or later.
For Google Chrome version prior to 58.0.3029.83 on Android, update to version 58.0.3029.83 or later.
As a temporary workaround, consider restricting access to the
X-XSS-Protection header to minimize the risk of exploitation.Exploit
Correção
RCE
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Google Chrome
Opera
Red Hat
Suse