PT-2018-3794 · Yandex · Yandex Browser

Publicado 2018-01-19 · Atualizado 2018-02-05 · CVE-2017-7325

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Yandex Browser versions prior to 16.9.0

Description The issue allows remote attackers to spoof the address bar. This is due to insufficient input validation, which can be exploited by a remote attacker to modify the address bar value using the window.open function.

Recommendations For versions prior to 16.9.0, update to version 16.9.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the window.open function until a patch is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2022-03579

CVE-2017-7325

Produtos afetados

Yandex Browser

Referências · 5

• https://browser.yandex.com/security/changelogs/fixed-in-version-16-9 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-03579 · Nota de Segurança
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Nota
• https://osv.dev/vulnerability/CVE-2017-7325 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7325 · Nota de Segurança