CVE-2017-15393 - Vulnerability Details - OpenCVE

ReportizFlow

Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:62.0.3202.62-2.el6_9	cpe:/a:redhat:rhel_extras:6	RHSA-2017:2997	2017-10-20T00:00:00Z

References

Link	Providers
http://www.securityfocus.com/bid/101482
https://access.redhat.com/errata/RHSA-2017:2997
https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html
https://crbug.com/732751
https://nvd.nist.gov/vuln/detail/CVE-2017-15393
https://security.gentoo.org/glsa/201710-24
https://www.cve.org/CVERecord?id=CVE-2017-15393
https://www.debian.org/security/2017/dsa-4020

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2018-02-07T23:00:00

Updated: 2024-08-05T19:57:25.791Z

Reserved: 2017-10-17T00:00:00

Link: CVE-2017-15393

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-02-07T23:29:00.670

Modified: 2024-11-21T03:14:37.533

Link: CVE-2017-15393

Redhat

Severity : Low

Publid Date: 2017-10-17T00:00:00Z

Links: CVE-2017-15393 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Google Chrome prior to 62.0.3202.62", "vendor": "n/a", "versions": [{"status": "affected", "version": "Google Chrome prior to 62.0.3202.62"}]}], "datePublic": "2017-10-17T00:00:00", "descriptions": [{"lang": "en", "value": "Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak."}], "problemTypes": [{"descriptions": [{"description": "Insufficient Policy Enforcement", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-08T10:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"name": "101482", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/101482"}, {"tags": ["x_refsource_MISC"], "url": "https://crbug.com/732751"}, {"tags": ["x_refsource_MISC"], "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html"}, {"name": "DSA-4020", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2017/dsa-4020"}, {"name": "RHSA-2017:2997", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:2997"}, {"name": "GLSA-201710-24", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201710-24"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2017-15393", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Google Chrome prior to 62.0.3202.62", "version": {"version_data": [{"version_value": "Google Chrome prior to 62.0.3202.62"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Insufficient Policy Enforcement"}]}]}, "references": {"reference_data": [{"name": "101482", "refsource": "BID", "url": "http://www.securityfocus.com/bid/101482"}, {"name": "https://crbug.com/732751", "refsource": "MISC", "url": "https://crbug.com/732751"}, {"name": "https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html", "refsource": "MISC", "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html"}, {"name": "DSA-4020", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2017/dsa-4020"}, {"name": "RHSA-2017:2997", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:2997"}, {"name": "GLSA-201710-24", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201710-24"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T19:57:25.791Z"}, "title": "CVE Program Container", "references": [{"name": "101482", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/101482"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://crbug.com/732751"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html"}, {"name": "DSA-4020", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2017/dsa-4020"}, {"name": "RHSA-2017:2997", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:2997"}, {"name": "GLSA-201710-24", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201710-24"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2017-15393", "datePublished": "2018-02-07T23:00:00", "dateReserved": "2017-10-17T00:00:00", "dateUpdated": "2024-08-05T19:57:25.791Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A8B890B-083C-4977-8C31-AAC2F13E96A1", "versionEndExcluding": "62.0.3202.62", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Insufficient Policy Enforcement in Devtools remote debugging in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to obtain access to remote debugging functionality via a crafted HTML page, aka a Referer leak."}, {"lang": "es", "value": "La aplicaci\u00f3n de pol\u00edticas insuficiente en la depuraci\u00f3n remota de Devtools en Google Chrome, en versiones anteriores a la 62.0.3202.62, permite que un atacante remoto obtenga acceso a la funcionalidad de depuraci\u00f3n remota mediante una p\u00e1gina HTML manipulada. Esto tambi\u00e9n se conoce como fuga de Referers."}], "id": "CVE-2017-15393", "lastModified": "2024-11-21T03:14:37.533", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2018-02-07T23:29:00.670", "references": [{"source": "[email protected]", "url": "http://www.securityfocus.com/bid/101482"}, {"source": "[email protected]", "url": "https://access.redhat.com/errata/RHSA-2017:2997"}, {"source": "[email protected]", "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html"}, {"source": "[email protected]", "url": "https://crbug.com/732751"}, {"source": "[email protected]", "url": "https://security.gentoo.org/glsa/201710-24"}, {"source": "[email protected]", "url": "https://www.debian.org/security/2017/dsa-4020"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/101482"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:2997"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/732751"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201710-24"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.debian.org/security/2017/dsa-4020"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "[email protected]", "type": "Primary"}]}