CVE-2020-6401

EPSS 0.78%
Published 11.02.2020 15:15:13
Last modified 21.11.2024 05:35:39
Source chrome-cve-admin@google.com
Teams watchlist Login
Open Login

Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.

Affected products Warnungen 0 Metrics 3 CWE 1 References 12

Data is provided by the National Vulnerability Database (NVD)

Google ≫ Chrome Version < 80.0.3987.87

Opensuse ≫ Backports Sle Version15.0 Updatesp1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.78%	0.727

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html

https://access.redhat.com/errata/RHSA-2020:0514

https://security.gentoo.org/glsa/202003-08

https://www.debian.org/security/2020/dsa-4638

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6IOHSO6BUKC6I66J5PZOMAGFVJ66ZS57/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X3B5RWJQD5LA45MYLLR55KZJOJ5NVZGP/

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop.html

Vendor Advisory

https://crbug.com/1017707

Permissions Required

https://nvd.nist.gov/vuln/detail/CVE-2020-6401

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2020-6401

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2020-6401

EUVD