PT-2024-13257 · Google · Chromium

Andrea Palanca · Published 2024-03-05 · Updated 2024-10-17 · CVE-2023-45593

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AiLux imx6 bundle versions prior to imx6 1.0.7-2

Description A vulnerability in the embedded Chromium browser, concerning the handling of alternative URLs other than "http://localhost", allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device.

Recommendations For AiLux imx6 bundle versions prior to imx6 1.0.7-2, update to version imx6 1.0.7-2 or later to resolve the issue. As a temporary workaround, consider restricting access to the embedded Chromium browser until a patch is available. Avoid using alternative URLs other than "http://localhost" in the embedded browser until the issue is resolved.

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2023-45593

Affected Products

Chromium

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-45593 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45593 · Vendor Advisory
• https://t.me/cvenotify/73004 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1765008392572047587 · Twitter Post
• https://t.me/cvenotify/98431 · Telegram Post
• https://twitter.com/CVEnew/status/1764978591186485485 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593 · Note
• https://t.me/cvenotify/96530 · Telegram Post