CVE-2015-1244 — Sensitive Information Exposure in Google Chrome

CWE-200 — Sensitive Information ExposureCWE-305 — Authentication Bypass by Primary Weakness7 documents6 sources
Severity
5.0MEDIUMNVD
EPSS
1.1%
top 21.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Google ChromeCanonical Ubuntu LinuxDebian Linux
Timeline
PublishedApr 19
Latest updateMay 17

Description

The URLRequest::GetHSTSRedirect function in url_request/url_request.cc in Google Chrome before 42.0.2311.90 does not replace the ws scheme with the wss scheme whenever an HSTS Policy is active, which makes it easier for remote attackers to obtain sensitive information by sniffing the network for WebSocket traffic.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDgoogle/chrome42.0.2311.60

Also affects: Debian Linux 8.0, Ubuntu Linux 14.04, 14.10, 15.04

🔴Vulnerability Details

3
GHSA
GHSA-g86g-ggjj-ppxm: The URLRequest::GetHSTSRedirect function in url_request/url_request↗2022-05-17
▶
OSV
oxide-qt vulnerabilities↗2015-04-27
▶
OSV
CVE-2015-1244: The URLRequest::GetHSTSRedirect function in url_request/url_request↗2015-04-19
▶

📋Vendor Advisories

2
Ubuntu
Oxide vulnerabilities↗2015-04-27
▶
Red Hat
chromium-browser: HSTS bypass in WebSockets↗2015-04-14
▶

💬Community

1
Bugzilla
CVE-2015-1244 chromium-browser: HSTS bypass in WebSockets↗2015-04-15
▶