CVE Vulnerability

CVE-2019-18893

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/ Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:video_downloader_project:video_downloader:*:*:*:*:*:*:*:*
cpe:2.3:a:avg:secure_browser:77.0.1790.77:*:*:*:*:*:*:*
cpe:2.3:a:avast:secure_browser:77.1.1831.91:*:*:*:*:*:*:*
Information

Published : 2020-01-13 05:15

Updated : 2020-01-22 07:47

NVD link : CVE-2019-18893

Mitre link : CVE-2019-18893

Products Affected
No products.
CWE
CWE-79