SB2017081615 - Backdoor in Infinity New Tab Google Chrome extension

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017081615

SB2017081615 - Backdoor in Infinity New Tab Google Chrome extension

Published: August 16, 2017

Security Bulletin ID SB2017081615
CSH Severity
Critical
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Backdoor (CVE-ID: N/A)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red


The vulnerability allows a remote attacker to gain unauthorized access to victim's browser.

The vulnerability exists due to presence of backdoor code in Infinity New Tab Google Chrome extension 3.12.3, distributed via Google Web Store.



Remediation

Install update from vendor's website.

References