CVE-2017-15397 Information disclosure in Google Chrome OS prior to 62.0.3202.74
Remote attackers in privileged network positions can observe or tamper with cleartext HTTP requests in Chrome OS due to inappropriate ChromeVox implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-15397?
CVE-2017-15397 is a high-severity vulnerability in Google Chrome Os, published on 7 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position.
Weakness: CWE-311
Which versions are affected by CVE-2017-15397?
It affects 1 product.
Products include Google Chrome Os.
How do I fix CVE-2017-15397?
No fix has been published for CVE-2017-15397 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-15397 being exploited?
There is no known exploitation of CVE-2017-15397 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome Os
Sources
Also known as GHSA-fvmw-p7gf-4cq2.