CVE-2015-1247 — Sensitive Information Exposure in Google Chrome

CWE-200 — Sensitive Information ExposureCWE-305 — Authentication Bypass by Primary Weakness5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
1.1%
top 22.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google ChromeDebian Linux
Timeline
PublishedApr 19
Latest updateMay 17

Description

The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper.cc in Google Chrome before 42.0.2311.90 does not prevent use of a file: URL for an OpenSearch descriptor XML document, which might allow remote attackers to obtain sensitive information from local files via a crafted (1) http or (2) https web site.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDgoogle/chrome42.0.2311.60

Also affects: Debian Linux 7.0

🔴Vulnerability Details

2
GHSA
GHSA-c9f4-c4vv-377j: The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper↗2022-05-17
▶
OSV
CVE-2015-1247: The SearchEngineTabHelper::OnPageHasOSDD function in browser/ui/search_engines/search_engine_tab_helper↗2015-04-19
▶

📋Vendor Advisories

1
Red Hat
chromium-browser: Scheme issues in OpenSearch↗2015-04-14
▶

💬Community

1
Bugzilla
CVE-2015-1247 chromium-browser: Scheme issues in OpenSearch↗2015-04-15
▶