8.8

CVE-2023-4357

Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Chrome Version < 116.0.5845.96
Debian ≫ Debian Linux Version 11.0
Debian ≫ Debian Linux Version 12.0
Fedoraproject ≫ Fedora Version 38
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 47.12% 0.987
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://security.gentoo.org/glsa/202401-34
https://chromereleases.googleblog.com/2023/08/stable-channel-update-for-desktop_15.html
Vendor Advisory
Release Notes
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DMXHPRUGBUDNHZCZCIVMWAUIEXEGMGT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OCFEK63FUHFXZH5MSG6TNQOXMQWM4M5S/
Third Party Advisory
Mailing List
https://www.debian.org/security/2023/dsa-5479
Third Party Advisory
https://crbug.com/1458911
Permissions Required