CVE-2020-36765

Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html	Vendor Advisory
https://issues.chromium.org/issues/40091076	Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

History

19 Oct 2024, 00:37

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:a:google:chrome::::::::
First Time		Google Google chrome
Summary		(es) La aplicación insuficiente de políticas en la navegación en Google Chrome antes de la versión 85.0.4183.83 permitió que un atacante remoto filtrara datos de orígenes cruzados a través de una página HTML manipulada. (Severidad de seguridad de Chromium: media)
References	~~() https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html -~~	() https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html - Vendor Advisory
References	~~() https://issues.chromium.org/issues/40091076 -~~	() https://issues.chromium.org/issues/40091076 - Issue Tracking
CWE		NVD-CWE-noinfo

16 Jul 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-16 23:15

Updated : 2024-11-06 20:35

NVD link : CVE-2020-36765

Mitre link : CVE-2020-36765

CVE.ORG link : CVE-2020-36765

JSON object : View

Products Affected

google

chrome

CWE

NVD-CWE-noinfo

{"id": "CVE-2020-36765", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-07-16T23:15:10.497", "references": [{"url": "https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html", "tags": ["Vendor Advisory"], "source": "chrome-cve-admin@google.com"}, {"url": "https://issues.chromium.org/issues/40091076", "tags": ["Issue Tracking"], "source": "chrome-cve-admin@google.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Insufficient policy enforcement in Navigation in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)"}, {"lang": "es", "value": "La aplicaci\u00f3n insuficiente de pol\u00edticas en la navegaci\u00f3n en Google Chrome antes de la versi\u00f3n 85.0.4183.83 permiti\u00f3 que un atacante remoto filtrara datos de or\u00edgenes cruzados a trav\u00e9s de una p\u00e1gina HTML manipulada. (Severidad de seguridad de Chromium: media)"}], "lastModified": "2024-11-06T20:35:02.123", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5788E379-6BBF-4A6D-94EE-785AFC473A78", "versionEndExcluding": "85.0.4183.83"}], "operator": "OR"}]}], "sourceIdentifier": "chrome-cve-admin@google.com"}