CVE-2009-0411

2009-02-0319:30:00

CWE-264

[email protected]

web.nvd.nist.gov

cve-2009-0411

google chrome

web security

access restriction

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.7%

JSON

Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.

Affected configurations

NVD

Node

googlechromeRange≤1.0.154.43

googlechromeMatch0.2.152.1

googlechromeMatch0.2.153.1

googlechromeMatch0.3.154.0

googlechromeMatch0.3.154.3

googlechromeMatch0.4.154.18

googlechromeMatch0.4.154.22

googlechromeMatch0.4.154.31

googlechromeMatch0.4.154.33

googlechromeMatch1.0.154.36

googlechromeMatch1.0.154.39

googlechromeMatch1.0.154.42

CPENameOperatorVersion
google:chromegoogle chromele1.0.154.43
google:chromegoogle chromeeq0.2.152.1
google:chromegoogle chromeeq0.2.153.1
google:chromegoogle chromeeq0.3.154.0
google:chromegoogle chromeeq0.3.154.3
google:chromegoogle chromeeq0.4.154.18
google:chromegoogle chromeeq0.4.154.22
google:chromegoogle chromeeq0.4.154.31
google:chromegoogle chromeeq0.4.154.33
google:chromegoogle chromeeq1.0.154.36

CPE	Name	Operator	Version
google:chrome	google chrome	le	1.0.154.43
google:chrome	google chrome	eq	0.2.152.1
google:chrome	google chrome	eq	0.2.153.1
google:chrome	google chrome	eq	0.3.154.0
google:chrome	google chrome	eq	0.3.154.3
google:chrome	google chrome	eq	0.4.154.18
google:chrome	google chrome	eq	0.4.154.22
google:chrome	google chrome	eq	0.4.154.31
google:chrome	google chrome	eq	0.4.154.33
google:chrome	google chrome	eq	1.0.154.36