CVE-2023-0132 - Vulnerability Details - OpenCVE

Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Google	Chrome
Microsoft	Windows

Configuration 1 [-]

AND

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html
https://crbug.com/1371215
https://security.gentoo.org/glsa/202305-10
https://security.gentoo.org/glsa/202311-11

History

Thu, 20 Mar 2025 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-346
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2023-01-10T00:00:00.000Z

Updated: 2025-03-20T20:49:24.229Z

Reserved: 2023-01-09T00:00:00.000Z

Link: CVE-2023-0132

Vulnrichment

Updated: 2024-08-02T05:02:43.721Z

NVD

Status : Modified

Published: 2023-01-10T20:15:10.923

Modified: 2025-03-20T21:15:16.060

Link: CVE-2023-0132

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-0132", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "dateUpdated": "2025-03-20T20:49:24.229Z", "dateReserved": "2023-01-09T00:00:00.000Z", "datePublished": "2023-01-10T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2023-11-25T11:09:08.565Z"}, "descriptions": [{"lang": "en", "value": "Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)"}], "affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "unspecified", "lessThan": "109.0.5414.74", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html"}, {"url": "https://crbug.com/1371215"}, {"name": "GLSA-202305-10", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202305-10"}, {"name": "GLSA-202311-11", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202311-11"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Inappropriate implementation"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:02:43.721Z"}, "title": "CVE Program Container", "references": [{"url": "https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html", "tags": ["x_transferred"]}, {"url": "https://crbug.com/1371215", "tags": ["x_transferred"]}, {"name": "GLSA-202305-10", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202305-10"}, {"name": "GLSA-202311-11", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202311-11"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-346", "lang": "en", "description": "CWE-346 Origin Validation Error"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-06T15:57:42.200954Z", "id": "CVE-2023-0132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-20T20:49:24.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html", "tags": ["x_transferred"]}, {"url": "https://crbug.com/1371215", "tags": ["x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202305-10", "name": "GLSA-202305-10", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202311-11", "name": "GLSA-202311-11", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T05:02:43.721Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-0132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-06T15:57:42.200954Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346 Origin Validation Error"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-06T15:57:43.535Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "109.0.5414.74", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html"}, {"url": "https://crbug.com/1371215"}, {"url": "https://security.gentoo.org/glsa/202305-10", "name": "GLSA-202305-10", "tags": ["vendor-advisory"]}, {"url": "https://security.gentoo.org/glsa/202311-11", "name": "GLSA-202311-11", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2023-11-25T11:09:08.565Z"}}}, "cveMetadata": {"cveId": "CVE-2023-0132", "state": "PUBLISHED", "dateUpdated": "2025-03-20T20:49:24.229Z", "dateReserved": "2023-01-09T00:00:00.000Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2023-01-10T00:00:00.000Z", "assignerShortName": "Chrome"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "928C6CC5-27ED-419A-A48E-567D24444D52", "versionEndExcluding": "109.0.5414.74", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force acceptance of a permission prompt via a crafted HTML page. (Chromium security severity: Medium)"}, {"lang": "es", "value": "La implementaci\u00f3n inadecuada de las solicitudes de permiso en Google Chrome en Windows anteriores a 109.0.5414.74 permiti\u00f3 a un atacante remoto forzar la aceptaci\u00f3n de una solicitud de permiso a trav\u00e9s de una p\u00e1gina HTML manipulada. (Severidad de seguridad de Chromium: media)"}], "id": "CVE-2023-0132", "lastModified": "2025-03-20T21:15:16.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-10T20:15:10.923", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://crbug.com/1371215"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/202305-10"}, {"source": "chrome-cve-admin@google.com", "url": "https://security.gentoo.org/glsa/202311-11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://chromereleases.googleblog.com/2023/01/stable-channel-update-for-desktop.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://crbug.com/1371215"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202305-10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/202311-11"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-346"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}