CVE-2015-1244

2015-04-1910:59:00

CWE-200

[email protected]

web.nvd.nist.gov

cve-2015-1244

urlrequest

gethstsredirect

google chrome

security

information

websocket

sniffing

hsts policy

5.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

78.2%

JSON

The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.

CPENameOperatorVersion
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.10
canonical:ubuntu_linuxcanonical ubuntu linuxeq14.04
canonical:ubuntu_linuxcanonical ubuntu linuxeq15.04
debian:debian_linuxdebian debian linuxeq8.0
google:chromegoogle chromele42.0.2311.60

CPE	Name	Operator	Version
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.10
canonical:ubuntu_linux	canonical ubuntu linux	eq	14.04
canonical:ubuntu_linux	canonical ubuntu linux	eq	15.04
debian:debian_linux	debian debian linux	eq	8.0
google:chrome	google chrome	le	42.0.2311.60