CVE-2018-11713
webkitgtk: WebSockets don't use system proxy settings
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp en el backend de red de WebKit, tal y como se emplea en WebKitGTK+ en versiones anteriores a la 2.20.0 o sin libsoup 2.62.0, falló inesperadamente a la hora de emplear las opciones de proxy del sistema para las conexiones WebSocket. Como resultado, los usuarios pueden perder su anonimato mediante sitios web manipulados a los que se accede a través de una conexión WebSocket.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2018-06-04 CVE Reserved
- 2018-06-04 CVE Published
- 2023-10-26 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (5)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugs.webkit.org/show_bug.cgi?id=126384 | 2019-10-03 | |
https://trac.webkit.org/changeset/228088/webkit | 2019-10-03 |
URL | Date | SRC |
---|---|---|
https://security.gentoo.org/glsa/201808-04 | 2019-10-03 | |
https://access.redhat.com/security/cve/CVE-2018-11713 | 2018-10-30 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1588739 | 2018-10-30 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Webkitgtk Search vendor "Webkitgtk" | Webkitgtk\+ Search vendor "Webkitgtk" for product "Webkitgtk\+" | < 2.20.0 Search vendor "Webkitgtk" for product "Webkitgtk\+" and version " < 2.20.0" | - |
Affected
| ||||||
Gnome Search vendor "Gnome" | Libsoup Search vendor "Gnome" for product "Libsoup" | < 2.62.0 Search vendor "Gnome" for product "Libsoup" and version " < 2.62.0" | - |
Affected
|