CVE-2017-5041 - Vulnerability Details - OpenCVE

Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Chrome
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
chromium-browser-0:57.0.2987.98-1.el6	cpe:/a:redhat:rhel_extras:6	RHSA-2017:0499	2017-03-14T00:00:00Z

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2017-0499.html
http://www.debian.org/security/2017/dsa-3810
http://www.securityfocus.com/bid/96767
https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
https://crbug.com/642490
https://nvd.nist.gov/vuln/detail/CVE-2017-5041
https://security.gentoo.org/glsa/201704-02
https://www.cve.org/CVERecord?id=CVE-2017-5041

History

No history.

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2017-04-24T23:00:00

Updated: 2024-08-05T14:47:44.430Z

Reserved: 2017-01-02T00:00:00

Link: CVE-2017-5041

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-04-24T23:59:00.563

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-5041

Redhat

Severity : Moderate

Publid Date: 2017-03-09T00:00:00Z

Links: CVE-2017-5041 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Google Chrome prior to 57.0.2987.100", "vendor": "n/a", "versions": [{"status": "affected", "version": "Google Chrome prior to 57.0.2987.100"}]}], "datePublic": "2017-03-09T00:00:00", "descriptions": [{"lang": "en", "value": "Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page."}], "problemTypes": [{"descriptions": [{"description": "incorrect security UI", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201704-02", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201704-02"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://crbug.com/642490"}, {"name": "DSA-3810", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2017/dsa-3810"}, {"name": "96767", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/96767"}, {"name": "RHSA-2017:0499", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0499.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@google.com", "ID": "CVE-2017-5041", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Google Chrome prior to 57.0.2987.100", "version": {"version_data": [{"version_value": "Google Chrome prior to 57.0.2987.100"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "incorrect security UI"}]}]}, "references": {"reference_data": [{"name": "https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html", "refsource": "CONFIRM", "url": "https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201704-02", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201704-02"}, {"name": "https://crbug.com/642490", "refsource": "CONFIRM", "url": "https://crbug.com/642490"}, {"name": "DSA-3810", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2017/dsa-3810"}, {"name": "96767", "refsource": "BID", "url": "http://www.securityfocus.com/bid/96767"}, {"name": "RHSA-2017:0499", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0499.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:47:44.430Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html"}, {"name": "GLSA-201704-02", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201704-02"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://crbug.com/642490"}, {"name": "DSA-3810", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2017/dsa-3810"}, {"name": "96767", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/96767"}, {"name": "RHSA-2017:0499", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0499.html"}]}]}, "cveMetadata": {"assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2017-5041", "datePublished": "2017-04-24T23:00:00", "dateReserved": "2017-01-02T00:00:00", "dateUpdated": "2024-08-05T14:47:44.430Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C2726A3-69F9-42F1-9006-C0AB35F7B182", "versionEndIncluding": "57.0.2987.98", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Google Chrome prior to 57.0.2987.100 incorrectly handled back-forward navigation, which allowed a remote attacker to display incorrect information for a site via a crafted HTML page."}, {"lang": "es", "value": "Google Chrome versiones anteriores a 57.0.2987.100 gestiona incorrectamente las acciones ir adelante/atr\u00e1s en la navegaci\u00f3n lo que permitir\u00eda a un atacante remoto mostrar informaci\u00f3n incorrecta de un sitio a trav\u00e9s de una p\u00e1gina HTML especialmente dise\u00f1ada."}], "id": "CVE-2017-5041", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-04-24T23:59:00.563", "references": [{"source": "chrome-cve-admin@google.com", "url": "http://rhn.redhat.com/errata/RHSA-2017-0499.html"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.debian.org/security/2017/dsa-3810"}, {"source": "chrome-cve-admin@google.com", "url": "http://www.securityfocus.com/bid/96767"}, {"source": "chrome-cve-admin@google.com", "url": "https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "url": "https://crbug.com/642490"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/201704-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2017-0499.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2017/dsa-3810"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/96767"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://crbug.com/642490"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201704-02"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}