PT-2023-5022 · Google · Google Chrome

Derin Eryilmaz · Publicado 2023-08-15 · Atualizado 2024-02-27 · CVE-2023-4369

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome on ChromeOS versions prior to 116.0.5845.120

Description The issue is related to insufficient data validation in Systems Extensions in Google Chrome on ChromeOS, which can be exploited by an attacker to bypass file restrictions via a crafted HTML page. This can occur if the attacker convinces a user to install a malicious extension. The estimated number of potentially affected devices and real-world incidents are not specified.

Recommendations For Google Chrome on ChromeOS versions prior to 116.0.5845.120, update to version 116.0.5845.120 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to minimize the risk of exploitation. Avoid using crafted HTML pages that could bypass file restrictions until the issue is resolved.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2023-05561

CVE-2023-4369

Produtos afetados

Google Chrome

Referências · 14

• https://twitter.com/CVEnew/status/1691501977232973824 · Publicação no Twitter
• https://twitter.com/fletch_ai/status/1695588711218471237 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4369 · Nota de Segurança
• https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-chromeos_25.html · Nota
• https://t.me/cybersecuritytechnologies/9418 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-05561 · Nota de Segurança
• https://t.me/s_e_reborn/4443 · Publicação no Telegram
• https://vuldb.com/?id.237228 · Nota
• https://t.me/cvenotify/57823 · Publicação no Telegram
• https://crbug.com/1464456 · Nota
• https://0x44.xyz/blog/cve-2023-4369 · Nota
• https://osv.dev/vulnerability/CVE-2023-4369 · Aviso do Fabricante
• https://twitter.com/0xor0ne/status/1762387140825043062 · Publicação no Twitter
• https://t.me/cibsecurity/68586 · Publicação no Telegram