CVE-2017-5075 : Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to

Inappropriate implementation in CSP reporting in Blink in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to obtain the value of url fragments via a crafted HTML page.

Published 2017-10-27 05:29:01

Updated 2022-04-06 19:30:22

Source Google Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2017-5075

Redhat » Enterprise Linux Desktop » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Matching versions
Google » Chrome
Versions before (<) 59.0.3071.86
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Macos » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Google » Chrome
Versions before (<) 59.0.3071.92
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Google » Android » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-5075

EPSS FAQ

0.56%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-5075

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2017-5075

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-5075

http://www.securityfocus.com/bid/98861

Google Chrome Prior to 59.0.3071.86 Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html

Chrome Releases: Stable Channel Update for Desktop
Vendor Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1038622

Google Chrome Multiple Flaws Let Remote Users Spoof URLs, Obtain Potentially Sensitive Information, and Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://crbug.com/678776

678776 - Security: Content-Security-Policy reporting leaks the URL fragment - chromium - Monorail
Exploit;Issue Tracking;Patch;Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1399

RHSA-2017:1399 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/201706-20

Chromium: Multiple vulnerabilities (GLSA 201706-20) — Gentoo security
Issue Tracking;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2017-5075

Products affected by CVE-2017-5075

Exploit prediction scoring system (EPSS) score for CVE-2017-5075

CVSS scores for CVE-2017-5075

CWE ids for CVE-2017-5075

References for CVE-2017-5075