CVE-2017-5060
Description
A flaw was found in the Omnibox (address bar) component of Chromium. A remote attacker can exploit this vulnerability by convincing a user to visit a specially crafted web page, causing the browser to display an incorrect URL. This issue can mislead users about the true identity of the website they are viewing, facilitating phishing attacks.
Détails du score du système commun d'évaluation des vulnérabilités (CVSS)
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
Répartition des scores CVSS v3
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Score de base | 6.5 | 6.5 | N/A |
| Vecteur d'attaque | Network | Network | N/A |
| Complexité de l'attaque | Low | Low | N/A |
| Privilèges requis | None | None | N/A |
| Interaction avec l'utilisateur | Required | Required | N/A |
| Champ d'application | Unchanged | Unchanged | N/A |
| Confidentialité | High | None | N/A |
| Impact sur l'intégrité | None | High | N/A |
| Impact sur la disponibilité | None | None | N/A |
Vecteur
Red Hat: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Comprendre la Défaillance (CWE)
Integrity,Confidentiality
Technical Impact: Other; Varies by Context; Hide Activities
An attacker may ultimately redirect a user to a malicious website, by deceiving the user into believing the URL they are accessing is a trusted domain. However, the attack can also be used to forge log entries by using homoglyphs in usernames. Homoglyph manipulations are often the first step towards executing advanced attacks such as stealing a user's credentials, Cross-Site Scripting (XSS), or log forgery. If an attacker redirects a user to a malicious site, the attacker can mimic a trusted domain to steal account credentials and perform actions on behalf of the user, without the user's knowledge. Similarly, an attacker could create a username for a website that contains homoglyph characters, making it difficult for an admin to review logs and determine which users performed which actions.
Questions fréquemment posées
Not sure what something means? Check out our Security Glossary.
Vous souhaitez recevoir des notifications d'errata ? Signez ici.
