Lucene search

ChromeCVE-2023-0139

HistoryJan 10, 2023 - 8:15 p.m.

CVE-2023-0139

2023-01-1020:15:11

CWE-20

Chrome

web.nvd.nist.gov

cve-2023-0139

insufficient validation

untrusted input

downloads

google chrome

windows

bypass

download restrictions

crafted html page

chromium security

low

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

50.2%

JSON

Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass download restrictions via a crafted HTML page. (Chromium security severity: Low)

Affected configurations

Nvd

Vulners

Node

googlechromeRange<109.0.5414.74

AND

microsoftwindowsMatch-

VendorProductVersionCPE
googlechrome*cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	chrome	*	cpe:2.3:a:google:chrome::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "vendor": "Google",
    "product": "Chrome",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "109.0.5414.74",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]