vulnwire
5.7med

CVE-2018-18358

Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment t…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
5.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 39%
Public exploits
0
none known

Lack of special casing of localhost in WPAD files in Google Chrome prior to 71.0.3578.80 allowed an attacker on the local network segment to proxy resources on localhost via a crafted WPAD file.

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 39% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.7CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD2.02.9AV:A/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Google Chrome

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds
Google Chrome (RSS, critical only)

References

  • crbug.com /899126 · x_refsource_MISC, x_transferred
  • chromereleases.googleblog.com /2018/12/stable-channel-update-for-desktop.html · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:3803 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4352 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/106084 · vdb-entry, x_refsource_BID, x_transferred
  • security.gentoo.org /glsa/201908-18 · vendor-advisory, x_refsource_GENTOO, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.