Vulnerability Details : CVE-2013-0909
The XSS Auditor in Google Chrome before 25.0.1364.152 allows remote attackers to obtain sensitive HTTP Referer information via unspecified vectors.
Vulnerability category: Cross site scripting (XSS)Information leak
Products affected by CVE-2013-0909
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.93:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.86:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.85:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.84:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.76:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.75:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.66:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.65:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.55:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.54:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.53:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.46:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.45:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.38:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.37:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.29:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.28:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.21:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.20:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.13:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.12:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.2:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.1:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.88:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.87:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.78:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.77:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.68:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.67:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.57:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.56:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.48:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.47:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.40:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.39:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.32:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.31:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.30:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.23:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.22:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.15:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.14:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.5:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.3:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.92:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.91:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.82:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.81:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.74:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.73:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.63:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.62:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.52:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.51:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.44:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.43:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.36:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.35:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.27:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.26:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.19:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.18:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.11:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.10:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.90:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.89:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.80:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.79:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.72:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.70:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.61:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.58:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.50:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.49:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.42:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.41:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.34:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.33:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.25:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.24:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.17:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.16:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.9:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.8:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.7:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.95:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.113:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.114:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.122:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.123:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.110:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.112:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.119:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.120:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.121:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.115:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.116:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.124:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.125:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.98:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.99:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.108:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.117:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:25.0.1364.118:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-0909
0.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 46 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-0909
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2013-0909
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-0909
-
http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html
Chrome Releases: Stable Channel UpdateVendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16132
Repository / Oval Repository
-
https://code.google.com/p/chromium/issues/detail?id=173906
173906 - document.referrer leakage with XSS Auditor page block - chromium - MonorailPatch;Issue Tracking
Jump to