PT-2009-4781 · Google · Google Chrome

Published 2009-07-07 · Updated 2018-10-10 · CVE-2009-2352

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions 1.0.154.48 and earlier Google Chrome version 2.0.172.28 Google Chrome version 2.0.172.37 Google Chrome version 3.0.193.2 Beta

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to injecting a Refresh header or specifying the content of a Refresh header in HTTP responses. This is due to the failure to block javascript: URIs in Refresh headers.

Recommendations For Google Chrome versions 1.0.154.48 and earlier, update to a version later than 1.0.154.48 to resolve the issue. For Google Chrome version 2.0.172.28, update to a version later than 2.0.172.28 to resolve the issue. For Google Chrome version 2.0.172.37, update to a version later than 2.0.172.37 to resolve the issue. For Google Chrome version 3.0.193.2 Beta, update to a version later than 3.0.193.2 Beta to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-2352

Affected Products

Google Chrome

References · 7

• 🔥 http://securityfocus.com/bid/35572 · Exploit
• 🔥 https://exploit-db.com/exploits/33064 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2352 · Security Note
• http://websecurity.com.ua/3275 · Note
• http://securityfocus.com/archive/1/504718/100/0/threaded · Note
• http://websecurity.com.ua/3386 · Note
• http://securityfocus.com/archive/1/504723/100/0/threaded · Note