Lucene search

ChromeCVE-2017-5120

HistoryOct 27, 2017 - 5:29 a.m.

CVE-2017-5120

2017-10-2705:29:02

Chrome

web.nvd.nist.gov

cve-2017-5120

google chrome

security vulnerability

https downgrade

url mismatch

html page

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.5

Confidence

High

EPSS

0.007

Percentile

80.2%

JSON

Inappropriate use of www mismatch redirects in browser navigation in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentially downgrade HTTPS requests to HTTP via a crafted HTML page. In other words, Chrome could transmit cleartext even though the user had entered an https URL, because of a misdesigned workaround for cases where the domain name in a URL almost matches the domain name in an X.509 server certificate (but differs in the initial “www.” substring).

Affected configurations

Nvd

Node

googlechromeRange<61.0.3163.79

AND

applemacosMatch-

linuxlinux_kernelMatch-

microsoftwindowsMatch-

Node

debiandebian_linuxMatch9.0

debiandebian_linuxMatch10.0

Node

googlechromeRange<61.0.3163.81

AND

googleandroidMatch-

Node

redhatenterprise_linux_desktopMatch6.0

redhatenterprise_linux_serverMatch6.0

redhatenterprise_linux_workstationMatch6.0

CNA Affected

[
  {
    "product": "Google Chrome prior to 61.0.3163.79 for Mac, Windows and Linux, and 61.0.3163.81 for Android",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Google Chrome prior to 61.0.3163.79 for Mac, Windows and Linux, and 61.0.3163.81 for Android"
      }
    ]
  }
]