6.8

CVE-2013-6634

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Chrome Version <= 31.0.1650.62
Google ≫ Chrome Version31.0.1650.0
Google ≫ Chrome Version31.0.1650.2
Google ≫ Chrome Version31.0.1650.3
Google ≫ Chrome Version31.0.1650.4
Google ≫ Chrome Version31.0.1650.5
Google ≫ Chrome Version31.0.1650.6
Google ≫ Chrome Version31.0.1650.7
Google ≫ Chrome Version31.0.1650.8
Google ≫ Chrome Version31.0.1650.9
Google ≫ Chrome Version31.0.1650.10
Google ≫ Chrome Version31.0.1650.11
Google ≫ Chrome Version31.0.1650.12
Google ≫ Chrome Version31.0.1650.13
Google ≫ Chrome Version31.0.1650.14
Google ≫ Chrome Version31.0.1650.15
Google ≫ Chrome Version31.0.1650.16
Google ≫ Chrome Version31.0.1650.17
Google ≫ Chrome Version31.0.1650.18
Google ≫ Chrome Version31.0.1650.19
Google ≫ Chrome Version31.0.1650.20
Google ≫ Chrome Version31.0.1650.22
Google ≫ Chrome Version31.0.1650.23
Google ≫ Chrome Version31.0.1650.25
Google ≫ Chrome Version31.0.1650.26
Google ≫ Chrome Version31.0.1650.27
Google ≫ Chrome Version31.0.1650.28
Google ≫ Chrome Version31.0.1650.29
Google ≫ Chrome Version31.0.1650.30
Google ≫ Chrome Version31.0.1650.31
Google ≫ Chrome Version31.0.1650.32
Google ≫ Chrome Version31.0.1650.33
Google ≫ Chrome Version31.0.1650.34
Google ≫ Chrome Version31.0.1650.35
Google ≫ Chrome Version31.0.1650.36
Google ≫ Chrome Version31.0.1650.37
Google ≫ Chrome Version31.0.1650.38
Google ≫ Chrome Version31.0.1650.39
Google ≫ Chrome Version31.0.1650.41
Google ≫ Chrome Version31.0.1650.42
Google ≫ Chrome Version31.0.1650.43
Google ≫ Chrome Version31.0.1650.44
Google ≫ Chrome Version31.0.1650.45
Google ≫ Chrome Version31.0.1650.46
Google ≫ Chrome Version31.0.1650.47
Google ≫ Chrome Version31.0.1650.48
Google ≫ Chrome Version31.0.1650.49
Google ≫ Chrome Version31.0.1650.50
Google ≫ Chrome Version31.0.1650.51
Google ≫ Chrome Version31.0.1650.52
Google ≫ Chrome Version31.0.1650.53
Google ≫ Chrome Version31.0.1650.54
Google ≫ Chrome Version31.0.1650.55
Google ≫ Chrome Version31.0.1650.57
Google ≫ Chrome Version31.0.1650.58
Google ≫ Chrome Version31.0.1650.59
Google ≫ Chrome Version31.0.1650.60
Google ≫ Chrome Version31.0.1650.61
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.31% 0.779
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.