CVE-2024-7004

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html	Release Notes
https://issues.chromium.org/issues/40063014	Issue Tracking Permissions Required

Configurations

Configuration 1 (hide)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

History

29 Oct 2024, 20:35

Type	Values Removed	Values Added
CWE		CWE-863

07 Aug 2024, 21:32

Type	Values Removed	Values Added
First Time		Google chrome Google
Summary		(es) La validación insuficiente de entradas no confiables en Navegación segura en Google Chrome antes de 127.0.6533.72 permitió que un atacante remoto convenciera a un usuario de realizar gestos de interfaz de usuario específicos para evitar el control de acceso discrecional a través de un archivo malicioso. (Severidad de seguridad de Chrome: baja)
CPE		cpe:2.3:a:google:chrome::::::::
References	~~() https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html -~~	() https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html - Release Notes
References	~~() https://issues.chromium.org/issues/40063014 -~~	() https://issues.chromium.org/issues/40063014 - Issue Tracking, Permissions Required
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3

06 Aug 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-06 16:15

Updated : 2024-10-29 20:35

NVD link : CVE-2024-7004

Mitre link : CVE-2024-7004

CVE.ORG link : CVE-2024-7004

JSON object : View

Products Affected

google

chrome

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

CWE-863

Incorrect Authorization

{"id": "CVE-2024-7004", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2024-08-06T16:15:50.760", "references": [{"url": "https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html", "tags": ["Release Notes"], "source": "chrome-cve-admin@google.com"}, {"url": "https://issues.chromium.org/issues/40063014", "tags": ["Issue Tracking", "Permissions Required"], "source": "chrome-cve-admin@google.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "chrome-cve-admin@google.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)"}, {"lang": "es", "value": "La validaci\u00f3n insuficiente de entradas no confiables en Navegaci\u00f3n segura en Google Chrome antes de 127.0.6533.72 permiti\u00f3 que un atacante remoto convenciera a un usuario de realizar gestos de interfaz de usuario espec\u00edficos para evitar el control de acceso discrecional a trav\u00e9s de un archivo malicioso. (Severidad de seguridad de Chrome: baja)"}], "lastModified": "2024-10-29T20:35:41.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65366FE2-8A36-426D-8960-39E8A6DF6DEA", "versionEndExcluding": "127.0.6533.72"}], "operator": "OR"}]}], "sourceIdentifier": "chrome-cve-admin@google.com"}