PT-2009-4513

CVE-2009-2060

Published

2009-06-15

Updated

2017-08-17

Description by

CVSS 2.0

5.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 1.0.154.53

Description The issue allows man-in-the-middle attackers to execute arbitrary web script by modifying the CONNECT response from a proxy server. This is achieved by using the HTTP Host header to determine the context of a document provided in a 4xx or 5xx CONNECT response.

Recommendations For versions prior to 1.0.154.53, update to version 1.0.154.53 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Adam Barth

Shuo Chen

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers