CVE-2016-8504 - OpenCVE

CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Yandex	Yandex Browser

Configuration 1 [-]

cpe:2.3:a:yandex:yandex_browser:*:*:*:*:*:*:*:*

References

Link	Resource
http://www.securityfocus.com/bid/93924	Third Party Advisory VDB Entry
https://browser.yandex.com/security/changelogs/	Release Notes Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: yandex

Published: 2016-10-26T18:00:00

Updated: 2016-11-25T19:57:01

Reserved: 2016-10-07T00:00:00

Link: CVE-2016-8504

JSON object: View

NVD Information

Status : Analyzed

Published: 2016-10-26T18:59:05.940

Modified: 2016-12-02T23:51:00.207

Link: CVE-2016-8504

JSON object: View

Redhat Information

No data.

CWE

CWE-352

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yandex:yandex_browser:*:*:*:*:*:*:*:*", "matchCriteriaId": "274E14F1-FEB9-45DB-A170-9A7C8C8269EF", "versionEndIncluding": "16.6.1.30165", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "CSRF of synchronization form in Yandex Browser for desktop before version 16.6 could be used by remote attacker to steal saved data in browser profile."}, {"lang": "es", "value": "CSRF de forma de sincronizaci\u00f3n en Yandex Browser para escritorio en versiones anteriores a 16.6 podr\u00eda ser usado por atacantes remotos para robar datos guardados en el perfil del navegador."}], "id": "CVE-2016-8504", "lastModified": "2016-12-02T23:51:00.207", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-10-26T18:59:05.940", "references": [{"source": "browser-security@yandex-team.ru", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/93924"}, {"source": "browser-security@yandex-team.ru", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://browser.yandex.com/security/changelogs/"}], "sourceIdentifier": "browser-security@yandex-team.ru", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}