PT-2018-13816 · Giorgio Maone+1 · Noscript Classic+1

Publicado 2018-09-13 · Atualizado 2019-10-03 · CVE-2018-16983

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NoScript Classic versions prior to 5.1.8.7 Tor Browser versions 7.x

Description The issue allows attackers to bypass script blocking by utilizing the text/html;/json Content-Type value.

Recommendations For NoScript Classic versions prior to 5.1.8.7, update to version 5.1.8.7 or later. For Tor Browser versions 7.x, consider updating NoScript Classic to version 5.1.8.7 or later as a temporary workaround, or update Tor Browser to a version that includes the fixed NoScript Classic.

Correção

Identificadores relacionados

CVE-2018-16983

Produtos afetados

Noscript Classic

Tor Browser

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-16983 · Nota de Segurança
• https://twitter.com/Zerodium/status/1039127214602641409 · Nota
• https://osv.dev/vulnerability/CVE-2018-16983 · Aviso do Fabricante
• https://noscript.net/getit#classic · Nota
• https://zdnet.com/article/exploit-vendor-drops-tor-browser-zero-day-on-twitter · Nota