PT-2022-4554 · Google+3 · Google Chrome+3

Published 2022-07-21 · Updated 2024-06-15 · CVE-2022-2479

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 103.0.5060.134 Google Chrome on Android versions prior to 103.0.5060.134 Microsoft Edge (affected versions not specified)

Description The issue is related to insufficient validation of untrusted input in the File component of Google Chrome and Microsoft Edge browsers. This could allow an attacker to obtain potentially sensitive information from internal file directories via a crafted HTML page, if they convinced a user to install a malicious app. The attacker could exploit this issue remotely.

Recommendations For Google Chrome versions prior to 103.0.5060.134, update to version 103.0.5060.134 or later. For Google Chrome on Android versions prior to 103.0.5060.134, update to version 103.0.5060.134 or later. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Exposure of Resource to Wrong Sphere

RCE

Weakness Enumeration

CWE-668

CWE-20

Related Identifiers

BDU:2022-05431

CVE-2022-2479

DSA-5187-1

MGASA-2022-0268

OPENSUSE-SU-2022:10073-1

OPENSUSE-SU-2022:10087-1

OPENSUSE-SU-2022:10088-1

OPENSUSE-SU-2022_10087-1

OPENSUSE-SU-2022_10088-1

OPENSUSE-SU-2024:12198-1

OPENSUSE-SU-2024:12948-1

Affected Products

Astra Linux

Google Chrome

Edge

Suse

References · 2352

• https://osv.dev/vulnerability/openSUSE-SU-2022:10087-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202208-35 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2479 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-2479 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2022:10088-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2022/07/stable-channel-update-for-desktop_19.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/682247 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0268.html · Security Note
• https://crbug.com/1329987 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:10073-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKLJ3B3D5BCVWE3QNP4N7HHF26OHD567 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12198-1 · Vendor Advisory