CVE-2017-5033

MEDIUM

Description

Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.

References

http://rhn.redhat.com/errata/RHSA-2017-0499.html

http://www.debian.org/security/2017/dsa-3810

http://www.securityfocus.com/bid/96767

https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html

https://crbug.com/669086

https://security.gentoo.org/glsa/201704-02

https://twitter.com/Ma7h1as/status/907641276434063361

Details

Source: MITRE

Published: 2017-04-24

Updated: 2018-01-05

Type: CWE-284

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 2.8

Severity: MEDIUM