Vulnerability Details : CVE-2015-1244
The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.
Products affected by CVE-2015-1244
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-1244
1.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-1244
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2015-1244
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-1244
-
http://rhn.redhat.com/errata/RHSA-2015-0816.html
RHSA-2015:0816 - Security Advisory - Red Hat Customer Portal
-
http://ubuntu.com/usn/usn-2570-1
USN-2570-1: Oxide vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html
openSUSE-SU-2015:0748-1: moderate: Security update for Chromium
-
http://www.securitytracker.com/id/1032209
Google Chrome Multiple Bugs Let Remote Users Execute Arbitrary Code, Obtain Potentially Sensitive Information, and Bypass Same-Origin Restrictions - SecurityTracker
-
http://lists.opensuse.org/opensuse-updates/2015-11/msg00024.html
openSUSE-SU-2015:1887-1: moderate: Security update for chromium
-
https://chromium.googlesource.com/chromium/src/net/+/2359906c4fdfa9d44b045755d23fe5327c10e010
2359906c4fdfa9d44b045755d23fe5327c10e010 - chromium/src/net - Git at Google
-
https://security.gentoo.org/glsa/201506-04
Chromium: Multiple vulnerabilities (GLSA 201506-04) — Gentoo security
-
https://code.google.com/p/chromium/issues/detail?id=455215
455215 - Security: HSTS not applied to WebSocket - chromium - Monorail
-
http://www.debian.org/security/2015/dsa-3238
Debian -- Security Information -- DSA-3238-1 chromium-browser
-
http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
Chrome Releases: Stable Channel Update
Jump to