CVE-2018-6654
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Grammarly extension for Chrome是美国Grammarly公司的一款基于Chrome浏览器的语法检查扩展。 Grammarly extension for Chrome 2018-02-02之前版本中存在安全漏洞，该漏洞源于任意网站都可以访问身份验证令牌。远程攻击者可利用该漏洞获取身份验证令牌。
Possible ATT&CK Techniques 1 AI
T1595.001 · Scanning IP Blocks
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-6654
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an 'action: "user"' request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Grammarly extension for Chrome 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grammarly extension for Chrome是美国Grammarly公司的一款基于Chrome浏览器的语法检查扩展。 Grammarly extension for Chrome 2018-02-02之前版本中存在安全漏洞，该漏洞源于任意网站都可以访问身份验证令牌。远程攻击者可利用该漏洞获取身份验证令牌。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2018-6654
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-6654
请登录查看更多情报信息。
Other References for CVE-2018-6654 (1)
-
https://bugs.chromium.org/p/project-zero/issues/detail?id=1527 x_refsource_MISC
Same Patch Batch · n/a · 2018-02-06 · 52 CVEs total
| CVE-2014-5282 | Docker 安全漏洞 | |
| CVE-2018-6569 | West Wind Web Server 安全漏洞 | |
| CVE-2018-6656 | Z-BlogPHP 跨站请求伪造漏洞 | |
| CVE-2017-6201 | Sandstorm 安全漏洞 | |
| CVE-2018-6468 | WordPress flickrRSS插件跨站脚本漏洞 | |
| CVE-2018-6467 | WordPress flickrRSS插件跨站请求伪造漏洞 | |
| CVE-2018-6466 | WordPress flickrRSS插件跨站脚本漏洞 | |
| CVE-2018-6469 | WordPress flickrRSS插件跨站脚本漏洞 | |
| CVE-2015-3619 | Joomla! VirtueMart组件跨站脚本漏洞 | |
| CVE-2015-3618 | Nagios Business Process Intelligence 跨站脚本漏洞 | |
| CVE-2015-4400 | Ring video doorbells 安全漏洞 | |
| CVE-2014-5280 | boot2docker 安全漏洞 | |
| CVE-2014-5279 | boot2docker 安全漏洞 | |
| CVE-2018-6389 | WordPress 安全漏洞 | |
| CVE-2017-17663 | thttpd和mini_httpd 缓冲区错误漏洞 | |
| CVE-2018-6758 | Unbit uWSGI 缓冲区错误漏洞 | |
| CVE-2016-3957 | web2py 安全漏洞 | |
| CVE-2016-3954 | web2py 安全漏洞 | |
| CVE-2016-3953 | web2py sample Web应用程序 | |
| CVE-2016-3952 | web2py 安全漏洞 |
Showing top 20 of 52 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2018-6654
No comments yet