6.8

CVE-2013-6634

The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Chrome Version <= 31.0.1650.62
Google ≫ Chrome Version 31.0.1650.0
Google ≫ Chrome Version 31.0.1650.2
Google ≫ Chrome Version 31.0.1650.3
Google ≫ Chrome Version 31.0.1650.4
Google ≫ Chrome Version 31.0.1650.5
Google ≫ Chrome Version 31.0.1650.6
Google ≫ Chrome Version 31.0.1650.7
Google ≫ Chrome Version 31.0.1650.8
Google ≫ Chrome Version 31.0.1650.9
Google ≫ Chrome Version 31.0.1650.10
Google ≫ Chrome Version 31.0.1650.11
Google ≫ Chrome Version 31.0.1650.12
Google ≫ Chrome Version 31.0.1650.13
Google ≫ Chrome Version 31.0.1650.14
Google ≫ Chrome Version 31.0.1650.15
Google ≫ Chrome Version 31.0.1650.16
Google ≫ Chrome Version 31.0.1650.17
Google ≫ Chrome Version 31.0.1650.18
Google ≫ Chrome Version 31.0.1650.19
Google ≫ Chrome Version 31.0.1650.20
Google ≫ Chrome Version 31.0.1650.22
Google ≫ Chrome Version 31.0.1650.23
Google ≫ Chrome Version 31.0.1650.25
Google ≫ Chrome Version 31.0.1650.26
Google ≫ Chrome Version 31.0.1650.27
Google ≫ Chrome Version 31.0.1650.28
Google ≫ Chrome Version 31.0.1650.29
Google ≫ Chrome Version 31.0.1650.30
Google ≫ Chrome Version 31.0.1650.31
Google ≫ Chrome Version 31.0.1650.32
Google ≫ Chrome Version 31.0.1650.33
Google ≫ Chrome Version 31.0.1650.34
Google ≫ Chrome Version 31.0.1650.35
Google ≫ Chrome Version 31.0.1650.36
Google ≫ Chrome Version 31.0.1650.37
Google ≫ Chrome Version 31.0.1650.38
Google ≫ Chrome Version 31.0.1650.39
Google ≫ Chrome Version 31.0.1650.41
Google ≫ Chrome Version 31.0.1650.42
Google ≫ Chrome Version 31.0.1650.43
Google ≫ Chrome Version 31.0.1650.44
Google ≫ Chrome Version 31.0.1650.45
Google ≫ Chrome Version 31.0.1650.46
Google ≫ Chrome Version 31.0.1650.47
Google ≫ Chrome Version 31.0.1650.48
Google ≫ Chrome Version 31.0.1650.49
Google ≫ Chrome Version 31.0.1650.50
Google ≫ Chrome Version 31.0.1650.51
Google ≫ Chrome Version 31.0.1650.52
Google ≫ Chrome Version 31.0.1650.53
Google ≫ Chrome Version 31.0.1650.54
Google ≫ Chrome Version 31.0.1650.55
Google ≫ Chrome Version 31.0.1650.57
Google ≫ Chrome Version 31.0.1650.58
Google ≫ Chrome Version 31.0.1650.59
Google ≫ Chrome Version 31.0.1650.60
Google ≫ Chrome Version 31.0.1650.61
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.44% 0.697
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://lists.opensuse.org/opensuse-updates/2014-01/msg00042.html
http://googlechromereleases.blogspot.com/2013/12/stable-channel-update.html
Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00090.html
http://lists.opensuse.org/opensuse-updates/2013-12/msg00096.html
http://secunia.com/advisories/56217
http://www.debian.org/security/2013/dsa-2811
http://www.securitytracker.com/id/1029442
https://code.google.com/p/chromium/issues/detail?id=307159
https://src.chromium.org/viewvc/chrome?revision=236563&view=revision
Patch