CVE-2009-0411

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.

Google Chrome anterior a v1.0.154.46 no restringe adecuadamente el acceso de las páginas Web a las cabeceras de respuesta HTTP (1) Set-Cookie y (2) Set-Cookie2. Esto permite a atacantes remotos obtener información sensible de la cookies a través de llamadas XMLHttpRequest y otras secuencias de comandos web.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-02-03 CVE Reserved
2009-02-03 CVE Published
2023-03-07 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (5)

URL	Tag	Source
http://codereview.chromium.org/11264	X_refsource_confirm
http://codereview.chromium.org/18533	X_refsource_confirm
http://sites.google.com/a/chromium.org/dev/getting-involved/dev-channel/release-notes	X_refsource_confirm
http://src.chromium.org/viewvc/chrome?view=rev&revision=8529	X_refsource_confirm
https://exchange.xforce.ibmcloud.com/vulnerabilities/48554	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				<= 1.0.154.43 Search vendor "Google" for product "Chrome" and version " <= 1.0.154.43"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.2.152.1 Search vendor "Google" for product "Chrome" and version "0.2.152.1"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.2.153.1 Search vendor "Google" for product "Chrome" and version "0.2.153.1"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.3.154.0 Search vendor "Google" for product "Chrome" and version "0.3.154.0"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.3.154.3 Search vendor "Google" for product "Chrome" and version "0.3.154.3"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.4.154.18 Search vendor "Google" for product "Chrome" and version "0.4.154.18"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.4.154.22 Search vendor "Google" for product "Chrome" and version "0.4.154.22"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.4.154.31 Search vendor "Google" for product "Chrome" and version "0.4.154.31"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				0.4.154.33 Search vendor "Google" for product "Chrome" and version "0.4.154.33"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				1.0.154.36 Search vendor "Google" for product "Chrome" and version "1.0.154.36"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				1.0.154.39 Search vendor "Google" for product "Chrome" and version "1.0.154.39"		-		Affected
Google Search vendor "Google"		Chrome Search vendor "Google" for product "Chrome"				1.0.154.42 Search vendor "Google" for product "Chrome" and version "1.0.154.42"		-		Affected