CVE-2023-2465: Inappropriate implementation in CORS

Q: What is CVE-2023-2465?

CVE-2023-2465 is a vulnerability in the Chromium browser that allows a remote attacker to leak cross-origin data through a crafted HTML page.

Q: How severe is CVE-2023-2465?

CVE-2023-2465 is considered a medium severity vulnerability.

Q: Which software is affected by CVE-2023-2465?

Chromium versions prior to 113.0.5672.63, Microsoft Edge versions up to 113.0.1774.35, and Microsoft Edge (Chromium-based) are affected by CVE-2023-2465.

Q: How can I fix CVE-2023-2465?

To fix CVE-2023-2465, update your Chromium browser to at least version 113.0.5672.63 or upgrade to a secure version of Microsoft Edge.

Q: Where can I find more information about CVE-2023-2465?

You can find more information about CVE-2023-2465 in the references provided: https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop.html, https://crbug.com/1399862, https://www.debian.org/security/2023/dsa-5398

Published Dec 10, 2022

Updated

Chromium: CVE-2023-2465 Inappropriate implementation in CORS

Other sources

Inappropriate implementation in CORS in Google Chrome prior to 113.0.5672.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Credit

@@kunte_ctf

Affected Software

9 affected componentsFixes available

Microsoft Edge (Chromium-based)

Patch available

Microsoft Edge<113.0.1774.35

Google Chrome<113.0.5672.63

113.0.5672.63

Google Chrome<113.0.5672.63

Fedoraproject Fedora=36

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Debian Debian Linux=11.0

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 113.0.5672.63
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 113.0.5672.63

Event History

Dec 10, 2022

CVE Published

12:00 AM

May 2, 2023

CVE Published

via MITRE·11:47 PM

Data Sourced

via MITRE·11:47 PM

DescriptionWeakness

May 3, 2023

Data Sourced

12:15 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2023-2465?