CVE-2017-5118

MEDIUM

Description

Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.

References

http://www.debian.org/security/2017/dsa-3985

http://www.securityfocus.com/bid/100610

http://www.securitytracker.com/id/1039291

https://access.redhat.com/errata/RHSA-2017:2676

https://chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html

https://crbug.com/747847

https://security.gentoo.org/glsa/201709-15

Details

Source: MITRE

Published: 2017-10-27

Updated: 2019-10-03

Type: CWE-732

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3.0

Base Score: 4.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Impact Score: 1.4

Exploitability Score: 2.8

Severity: MEDIUM