CVE-2016-5225 - Vulnerability Details - OpenCVE

Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:55.0.2883.75-1.el6	cpe:/a:redhat:rhel_extras:6	RHSA-2016:2919	2016-12-07T00:00:00Z

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2016-2919.html
http://www.securityfocus.com/bid/94633
https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html
https://crbug.com/630332
https://googlechromereleases.blogspot.com/2016/12/stable-channel-update-for-desktop.html
https://nvd.nist.gov/vuln/detail/CVE-2016-5225
https://security.gentoo.org/glsa/201612-11
https://www.cve.org/CVERecord?id=CVE-2016-5225

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2017-01-19T05:43:00

Updated: 2024-08-06T00:53:48.605Z

Reserved: 2016-05-31T00:00:00

Link: CVE-2016-5225

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-01-19T05:59:01.103

Modified: 2024-11-21T02:53:52.663

Link: CVE-2016-5225

Redhat

Severity : Low

Publid Date: 2016-12-01T00:00:00Z

Links: CVE-2016-5225 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android", "vendor": "n/a", "versions": [{"status": "affected", "version": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android"}]}], "datePublic": "2016-12-01T00:00:00", "descriptions": [{"lang": "en", "value": "Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page."}], "problemTypes": [{"descriptions": [{"description": "insufficient policy enforcement", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"name": "RHSA-2016:2919", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/94633"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://crbug.com/630332"}, {"name": "GLSA-201612-11", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-11"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2016-5225", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android", "version": {"version_data": [{"version_value": "Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "insufficient policy enforcement"}]}]}, "references": {"reference_data": [{"name": "RHSA-2016:2919", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "refsource": "BID", "url": "http://www.securityfocus.com/bid/94633"}, {"name": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"name": "https://crbug.com/630332", "refsource": "CONFIRM", "url": "https://crbug.com/630332"}, {"name": "GLSA-201612-11", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-11"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T00:53:48.605Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2016:2919", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"name": "94633", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/94633"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://crbug.com/630332"}, {"name": "GLSA-201612-11", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-11"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2016-5225", "datePublished": "2017-01-19T05:43:00", "dateReserved": "2016-05-31T00:00:00", "dateUpdated": "2024-08-06T00:53:48.605Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "85349E1C-5290-4A05-B79B-142BE5B508B5", "versionEndIncluding": "54.0.2840.99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, which allowed a remote attacker to bypass Content Security Policy via a crafted HTML page."}, {"lang": "es", "value": "Blink en Google Chrome anterior a 55.0.2883.75 para Mac, Windows y Linux y 55.0.2883.84 para Android manej\u00f3 incorrectamente acciones de formularios, lo que permiti\u00f3 a un atacante remoto eludir la Content Security Policy a trav\u00e9s de una p\u00e1gina HTML manipulada."}], "id": "CVE-2016-5225", "lastModified": "2024-11-21T02:53:52.663", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-01-19T05:59:01.103", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/94633"}, {"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/630332"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201612-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2016-2919.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/94633"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2016/12/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/630332"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201612-11"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-19"}], "source": "nvd@nist.gov", "type": "Primary"}]}