CVE-2020-6519
published 2020-07-22CVE-2020-6519: Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
PriorityP349medium6.5CVSS 3.1
AVNACLPRNUIRSUCNIHAN
EXPLOIT
EPSS
11.32%
95.5th percentile
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 87.0.4280.88-0.1 | 87.0.4280.88-0.1 |
| chromium | chromium | >= 0 < 87.0.4280.88-0.1 | 87.0.4280.88-0.1 |
| chromium | chromium | >= 0 < 87.0.4280.88-0.1 | 87.0.4280.88-0.1 |
| chromium | chromium | >= 0 < 87.0.4280.88-0.1 | 87.0.4280.88-0.1 |
| debian | chromium | < chromium 87.0.4280.88-0.1 (bookworm) | chromium 87.0.4280.88-0.1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| chrome | < 84.0.4147.89 | 84.0.4147.89 | |
| chrome | >= unspecified < 84.0.4147.89 | 84.0.4147.89 | |
| chrome_chrome | — | — | |
| opensuse | backports_sle | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9jhg-945x-fwm5: Policy bypass in CSP in Google Chrome prior to 84
ghsa_unreviewed·2022-05-24
CVE-2020-6519 [MEDIUM] GHSA-9jhg-945x-fwm5: Policy bypass in CSP in Google Chrome prior to 84
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
OSV
CVE-2020-6519: Policy bypass in CSP in Google Chrome prior to 84
osv·2020-07-22·CVSS 6.5
CVE-2020-6519 [MEDIUM] CVE-2020-6519: Policy bypass in CSP in Google Chrome prior to 84
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Chrome
Stable Channel Update for Desktop: CVE-2020-6518
vendor_chrome·2020-07-14·CVSS 8.8
CVE-2020-6518 [MEDIUM] Stable Channel Update for Desktop: CVE-2020-6518
Stable Channel Update for Desktop
CVE-2020-6518: Use after free in developer tools. Reported by David Erceg on 2019-07-20
[$3000][ 1064676 ] Medium CVE-2020-6519: Policy bypass in CSP
Reported by Wenxu Wu (@ma7h1as) of Tencent Security Xuanwu Lab on 2019-04-23, and also by Gal Weizman (@WeizmanGal) of PerimeterX on 2020-03-25
Severity: medium
Red Hat
chromium-browser: Policy bypass in CSP
vendor_redhat·2020-07-14·CVSS 6.5
CVE-2020-6519 [MEDIUM] chromium-browser: Policy bypass in CSP
chromium-browser: Policy bypass in CSP
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Debian
CVE-2020-6519: chromium - Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote att...
vendor_debian·2020·CVSS 6.5
CVE-2020-6519 [MEDIUM] CVE-2020-6519: chromium - Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote att...
Policy bypass in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Scope: local
bookworm: resolved (fixed in 87.0.4280.88-0.1)
bullseye: resolved (fixed in 87.0.4280.88-0.1)
forky: resolved (fixed in 87.0.4280.88-0.1)
sid: resolved (fixed in 87.0.4280.88-0.1)
trixie: resolved (fixed in 87.0.4280.88-0.1)
No detection rules found.
arXiv
SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences
arxiv_fulltext·2024-05-14
SecScore: Enhancing the CVSS Threat Metric Group with Empirical Evidences
: Enhancing the CVSS Threat Metric Group with Empirical Evidences
Miguel Santana
Banco de PortugalPortugal
Vinicius V. Cogo
LASIGE, Informática, Faculdade de Ciências, Universidade de LisboaPortugal
Alan Oliveira de Sá
LASIGE, Informática, Faculdade de Ciências, Universidade de LisboaPortugal
printfolios=true
## Abstract
Background: Timely prioritising and remediating vulnerabilities are paramount in the dynamic cybersecurity field, and one of the most widely used vulnerability scoring systems (CVSS) does not address the increasing likelihood of emerging an exploit code.
Aims: We present , an innovative vulnerability severity score that enhances CVSS Threat metric group with statistical models from empirical evidences of real-world exploit codes.
Method: adjusts the traditional
Bugzilla
CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-
bugzilla·2020-07-15·CVSS 7.8
CVE-2020-6510 [HIGH] CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-
CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 ... chromium: various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant t
Bugzilla
CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-
bugzilla·2020-07-15·CVSS 7.8
CVE-2020-6510 [HIGH] CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-
CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 ... chromium: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the releva
Bugzilla
CVE-2020-6519 chromium-browser: Policy bypass in CSP
bugzilla·2020-07-15·CVSS 6.5
CVE-2020-6519 [MEDIUM] CVE-2020-6519 chromium-browser: Policy bypass in CSP
CVE-2020-6519 chromium-browser: Policy bypass in CSP
A policy bypass flaw was found in the CSP component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1064676
External References:
https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
Discussion:
Created chromium tracking bugs for this issue:
Affects: epel-all [bug 1857345]
Affects: fedora-all [bug 1857344]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Via RHSA-2020:3377 https://access.redhat.com/errata/RHSA-2020:3377
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2020-6519
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00041.htmlhttp://packetstormsecurity.com/files/160353/Chromium-83-CSP-Bypass.htmlhttps://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.htmlhttps://crbug.com/1064676https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTRPPTKZ2RKVH2XGQCWNFZ7FOGQ5LLCA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYIDWCHG24ZTFD4P42D4A4WWPPA74BCG/https://security.gentoo.org/glsa/202007-08https://www.debian.org/security/2021/dsa-4824http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-09/msg00041.htmlhttp://packetstormsecurity.com/files/160353/Chromium-83-CSP-Bypass.htmlhttps://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.htmlhttps://crbug.com/1064676https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTRPPTKZ2RKVH2XGQCWNFZ7FOGQ5LLCA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MYIDWCHG24ZTFD4P42D4A4WWPPA74BCG/https://security.gentoo.org/glsa/202007-08https://www.debian.org/security/2021/dsa-4824
2020-07-22
Published