CVE-2017-5045 : XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed det

XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.

Published 2017-04-24 23:59:01

Updated 2022-04-22 20:38:54

Source Google Inc.

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Exploit prediction scoring system (EPSS) score for CVE-2017-5045

Probability of exploitation activity in the next 30 days: 0.34%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 68 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2017-5045

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2017-5045

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-5045

https://security.gentoo.org/glsa/201704-02

Chromium: Multiple vulnerabilities (GLSA 201704-02) — Gentoo security
Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2017/dsa-3810

Debian -- Security Information -- DSA-3810-1 chromium-browser
Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2017-0499.html

RHSA-2017:0499 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html

Chrome Releases: Stable Channel Update for Desktop
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/96767

Google Chrome Prior to 57.0.2987.98 Multiple Security Vulnerabilities
Broken Link

CVEs referencing this url
https://crbug.com/667079

667079 - Security: Information Leak through XSS Auditor - chromium - Monorail
Issue Tracking;Patch;Vendor Advisory

Products affected by CVE-2017-5045

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Matching versions
Google » Chrome
Versions up to, including, (<=) 57.0.2987.75
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Google » Chrome
Versions up to, including, (<=) 57.0.2987.100
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Google » Android » Version: N/A

Vulnerability Details : CVE-2017-5045

Exploit prediction scoring system (EPSS) score for CVE-2017-5045

CVSS scores for CVE-2017-5045

CWE ids for CVE-2017-5045

References for CVE-2017-5045

Products affected by CVE-2017-5045