CVE-2019-11593

Опубликовано: 29 апр. 2019

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

In Adblock Plus before 3.5.2, the $rewrite filter option allows filter-list maintainers to run arbitrary code in a client-side session when a web service loads a script for execution using XMLHttpRequest or Fetch, and the script origin has an open redirect.

Ссылки

https://adblockplus.org/releases/adblock-plus-352-for-chrome-firefox-and-opera-released
Vendor Advisory
https://armin.dev/blog/2019/04/adblock-plus-code-injection/
Mitigation
Third Party Advisory
https://gitlab.com/eyeo/adblockplus/adblockpluschrome/issues/1
Third Party Advisory
https://gitlab.com/eyeo/adblockplus/adblockpluscore/issues/4
Third Party Advisory
https://news.ycombinator.com/item?id=19666504
Third Party Advisory
https://adblockplus.org/releases/adblock-plus-352-for-chrome-firefox-and-opera-released
Vendor Advisory
https://armin.dev/blog/2019/04/adblock-plus-code-injection/
Mitigation
Third Party Advisory
https://gitlab.com/eyeo/adblockplus/adblockpluschrome/issues/1
Third Party Advisory
https://gitlab.com/eyeo/adblockplus/adblockpluscore/issues/4
Third Party Advisory
https://news.ycombinator.com/item?id=19666504
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:adblockplus:adblock_plus:*:*:*:*:*:chrome:*:*

Версия до 3.5.2 (исключая)

EPSS

Процентиль: 73%

0.00776

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-cc5q-5938-jqm9