6.5

CVE-2018-6109

EPSS 1.41%
Veröffentlicht 09.01.2019 19:29:08
Zuletzt bearbeitet 21.11.2024 04:10:05
Erkennungen
Login

readAsText() can indefinitely read the file picked by the user, rather than only once at the time the file is picked in File API in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to access data on the user file system without explicit consent via a crafted HTML page.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 9

NVD 6 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Google ≫ Chrome Version < 66.0.3359.117

Debian ≫ Debian Linux Version 8.0

Debian ≫ Debian Linux Version 9.0

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 6.0

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.41%	0.692

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	6.5	2.8	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NIST	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://www.debian.org/security/2018/dsa-4182

http://www.securityfocus.com/bid/103917

https://access.redhat.com/errata/RHSA-2018:1195

https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html

https://security.gentoo.org/glsa/201804-22

https://crbug.com/710190

https://nvd.nist.gov/vuln/detail/CVE-2018-6109

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-6109

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-6109

EUVD