CVE-2011-3054

The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://code.google.com/p/chromium/issues/detail?id=117418	Vendor Advisory
http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html	Release Notes Vendor Advisory
http://secunia.com/advisories/48512	Not Applicable
http://security.gentoo.org/glsa/glsa-201203-19.xml	Third Party Advisory
http://secunia.com/advisories/48527	Not Applicable
http://osvdb.org/80292	Broken Link
http://www.securityfocus.com/bid/52674	Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1026841	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/74214	Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15028	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*

Information

Published : 2012-03-22 09:55

Updated : 2020-04-14 08:56

NVD link : CVE-2011-3054

Mitre link : CVE-2011-3054

JSON object : View

CWE

CWE-269

Improper Privilege Management

Products Affected

google

chrome

opensuse

opensuse

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://code.google.com/p/chromium/issues/detail?id=117418", "name": "http://code.google.com/p/chromium/issues/detail?id=117418", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html", "name": "http://googlechromereleases.blogspot.com/2012/03/stable-channel-update_21.html", "tags": ["Release Notes", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/48512", "name": "48512", "tags": ["Not Applicable"], "refsource": "SECUNIA"}, {"url": "http://security.gentoo.org/glsa/glsa-201203-19.xml", "name": "GLSA-201203-19", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}, {"url": "http://secunia.com/advisories/48527", "name": "48527", "tags": ["Not Applicable"], "refsource": "SECUNIA"}, {"url": "http://osvdb.org/80292", "name": "80292", "tags": ["Broken Link"], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/bid/52674", "name": "52674", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1026841", "name": "1026841", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74214", "name": "google-webui-weak-security(74214)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15028", "name": "oval:org.mitre.oval:def:15028", "tags": ["Third Party Advisory"], "refsource": "OVAL"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00000.html", "name": "openSUSE-SU-2012:0466", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "SUSE"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-269"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-3054", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2012-03-22T16:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "17.0.963.83"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2020-04-14T15:56Z"}

4.3 /10