Vulnerability Details : CVE-2017-5033
Potential exploit
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android failed to correctly propagate CSP restrictions to local scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page, related to the unsafe-inline keyword.
Products affected by CVE-2017-5033
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5033
0.66%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5033
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
2.8
|
1.4
|
NIST |
CWE ids for CVE-2017-5033
-
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5033
-
https://twitter.com/Ma7h1as/status/907641276434063361
Mathias on Twitter: "microsoft refused to fix the same problem (CVE-2017-5033 in chrome) so that the 'unsafe-inline' keyword means "really unsafe" in edge :)"Third Party Advisory
-
https://crbug.com/669086
669086 - Security: Circumvent CSP Header restrictions via about:blank - chromium - MonorailIssue Tracking;Patch;Vendor Advisory
-
https://security.gentoo.org/glsa/201704-02
Chromium: Multiple vulnerabilities (GLSA 201704-02) — Gentoo securityThird Party Advisory
-
http://www.debian.org/security/2017/dsa-3810
Debian -- Security Information -- DSA-3810-1 chromium-browserThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2017-0499.html
RHSA-2017:0499 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
Chrome Releases: Stable Channel Update for DesktopVendor Advisory
-
http://www.securityfocus.com/bid/96767
Google Chrome Prior to 57.0.2987.98 Multiple Security VulnerabilitiesBroken Link
Jump to