ByteOS Network

CVE Vulnerability Details :

CVE-2009-3011

PUBLISHED

More Info Official Page

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-31 Aug, 2009 | 16:00

Updated At-07 Aug, 2024 | 06:14

▼CVE Numbering Authority (CNA)

Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta does not properly block data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI or (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header. NOTE: the JavaScript executes outside of the context of the HTTP site.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

References

Hyperlink	Resource
http://websecurity.com.ua/3386/	x_refsource_MISC
http://websecurity.com.ua/3315/	x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/52998	vdb-entry x_refsource_XF

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://websecurity.com.ua/3386/	x_refsource_MISC x_transferred
http://websecurity.com.ua/3315/	x_refsource_MISC x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/52998	vdb-entry x_refsource_XF x_transferred

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References