CVE-2018-20068: Input Validation
Published Jan 9, 2019
·Updated
Incorrect handling of 304 status codes in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
Affected Software
2 affected componentsFixes available
Google Chrome<71.0.3578.80
debian/chromium
150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Event History
Jan 9, 2019
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-20068?
CVE-2018-20068 has a severity rating of medium.
2
How do I fix CVE-2018-20068?
To mitigate CVE-2018-20068, update Google Chrome to version 71.0.3578.80 or later.
3
What does CVE-2018-20068 affect?
CVE-2018-20068 affects Google Chrome versions prior to 71.0.3578.80.
4
What can an attacker do with CVE-2018-20068?
An attacker can exploit CVE-2018-20068 to confuse users regarding the origin of the current page by using a crafted HTML page.
5
When was CVE-2018-20068 reported?
CVE-2018-20068 was reported before the release of Google Chrome version 71.0.3578.80.