CVE-2017-5042
Summary
| CVE | CVE-2017-5042 |
|---|---|
| State | PUBLISHED |
| Assigner | Chrome |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-04-24 23:59:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent. |
Risk And Classification
Primary CVSS: v3.1 5.7 MEDIUM from [email protected]
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-311 | insufficient policy enforcement
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.7 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 3.3 | AV:A/AC:L/Au:N/C:P/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
AdjacentAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:A/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Macos | - | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Android | - | All | All | All | |
| Application | Chrome | All | All | All | All | |
| Application | Chrome | All | All | All | All | |
| Operating System | Linux | Linux Kernel | - | All | All | All |
| Operating System | Microsoft | Windows | - | All | All | All |
| Operating System | Redhat | Enterprise Linux Desktop | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Server | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux Workstation | 6.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Google Chrome Prior To 57.0.2987.98 For Mac Windows And Linux And 57.0.2987.108 For Android | affected Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Google Chrome Prior to 57.0.2987.98 Multiple Security Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Chromium: Multiple vulnerabilities (GLSA 201704-02) — Gentoo Security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| 671932 - Security: non-interactive request forcing - chromium - Monorail | af854a3a-2127-422b-91ae-364da2661108 | crbug.com | |
| Debian -- Security Information -- DSA-3810-1 chromium-browser | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Chrome Releases: Stable Channel Update for Desktop | af854a3a-2127-422b-91ae-364da2661108 | chromereleases.googleblog.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 710550 Gentoo Linux Chromium Multiple Vulnerabilities (GLSA 201704-02)