NVD Vulnerability Detail

CVE-2018-1000559

Summary	qutebrowser version introduced in v0.11.0 (1179ee7a937fb31414d77d9970bac21095358449) contains a Cross Site Scripting (XSS) vulnerability in history command, qute://history page that can result in Via injected JavaScript code, a website can steal the user's browsing history. This attack appear to be exploitable via the victim must open a page with a specially crafted <title> attribute, and then open the qute://history site via the :history command. This vulnerability appears to have been fixed in fixed in v1.3.3 (4c9360237f186681b1e3f2a0f30c45161cf405c7, to be released today) and v1.4.0 (5a7869f2feaa346853d2a85413d6527c87ef0d9f, released later this week).
Publication Date	June 27, 2018, 1:29 a.m.
Registration Date	March 1, 2021, 6:40 p.m.
Last Update	Nov. 21, 2024, 12:40 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:qutebrowser:qutebrowser::::::::		0.11.0			1.3.3

Related information, measures and tools

No	URL	タグ
1	https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7	Patch Third Party Advisory
2	https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7	Patch Third Party Advisory
3	https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9f	Patch Third Party Advisory
4	https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9f	Patch Third Party Advisory
5	https://github.com/qutebrowser/qutebrowser/issues/4011	Exploit Third Party Advisory
6	https://github.com/qutebrowser/qutebrowser/issues/4011	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

qutebrowser におけるクロスサイトスクリプティングの脆弱性

Title	qutebrowser におけるクロスサイトスクリプティングの脆弱性
Summary	qutebrowser には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 22, 2018, midnight
Registration Date	Sept. 20, 2018, 3:54 p.m.
Last Update	Sept. 20, 2018, 3:54 p.m.

Affected System

qutebrowser

qutebrowser 0.11.0 (1179ee7a937fb31414d77d9970bac21095358449)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-1000559	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000559
National Vulnerability Database (NVD)
2	CVE-2018-1000559	https://nvd.nist.gov/vuln/detail/CVE-2018-1000559

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
GitHub
1	Fix XSS issue on qute://history (4c93602)	https://github.com/qutebrowser/qutebrowser/commit/4c9360237f186681b1e3f2a0f30c45161cf405c7
2	Fix XSS issue on qute://history (5a7869f)	https://github.com/qutebrowser/qutebrowser/commit/5a7869f2feaa346853d2a85413d6527c87ef0d9f
3	History page parses and renders html tags #4011	https://github.com/qutebrowser/qutebrowser/issues/4011

Change Log

No	Changed Details	Date of change
1	[2018年09月20日] 掲載	Sept. 20, 2018, 3:54 p.m.