Vulnerability CVE-2013-2849 - CERT Civis.Net

Vulnerability Name:

CVE-2013-2849 (CCN-84412)

Assigned:

2013-05-21

Published:

2013-05-21

Updated:

2017-09-19

Summary:

Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome before 27.0.1453.93 allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2013-2849

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Release

Source: CONFIRM
Type: Vendor Advisory
http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html

Source: CCN
Type: SA53430
Google Chrome Multiple Vulnerabilities

Source: CCN
Type: SA53533
Debian chromium-browser Multiple Vulnerabilities

Source: DEBIAN
Type: UNKNOWN
DSA-2695

Source: DEBIAN
Type: DSA-2695-1
chromium-browser -- several issues

Source: DEBIAN
Type: DSA-2695
chromium-browser -- several issues

Source: CCN
Type: BID-60063
Google Chrome CVE-2013-2849 Cross Site Scripting Vulnerability

Source: CONFIRM
Type: Vendor Advisory
https://code.google.com/p/chromium/issues/detail?id=171392

Source: XF
Type: UNKNOWN
google-cve20132849-xss(84412)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:16753

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-2849

Vulnerable Configuration:

Configuration 1:

cpe:/a:google:chrome:27.0.1453.0:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.1:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.2:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.3:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.4:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.5:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.6:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.7:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.8:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.9:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.10:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.11:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.12:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.13:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.15:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.34:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.35:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.36:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.37:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.38:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.39:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.40:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.41:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.42:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.43:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.44:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.45:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.46:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.47:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.49:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.50:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.51:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.52:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.54:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.55:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.56:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.57:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.58:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.59:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.60:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.61:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.62:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.63:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.64:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.65:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.66:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.67:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.68:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.69:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.70:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.71:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.72:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.73:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.74:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.75:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.76:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.77:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.78:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.79:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.80:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.81:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.82:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.83:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.84:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.85:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.86:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.87:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.88:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.89:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:27.0.1453.90:*:*:*:*:*:*:*

OR cpe:/a:google:chrome:*:*:*:*:*:*:*:* (Version <= 27.0.1453.91)

Configuration CCN 1:

cpe:/a:google:chrome:27.0.1444.0:*:*:*:*:*:*:*

AND

cpe:/o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:18556	P	DSA-2695-1 chromium-browser - several	2014-06-23
oval:org.mitre.oval:def:16753	V	Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome before 27.0.1453.93 allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation	2013-08-12