CVE-2023-4357
Published: 15 August 2023
Summary
CVE-2023-4357 is a high-severity Improper Input Validation (CWE-20) vulnerability in Debian Debian Linux. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-4357 is an insufficient input validation flaw affecting the XML handling component in Google Chrome versions prior to 116.0.5845.96. The vulnerability stems from inadequate checks on untrusted input supplied through XML, which permits a remote attacker to circumvent file access restrictions when a victim visits a specially crafted HTML page. It was assigned a Chromium security severity of Medium and carries a CVSS 3.1 base score of 8.8.
A remote attacker with no prior privileges can exploit the issue simply by convincing a user to open a malicious web page. Successful exploitation allows the attacker to bypass intended file access controls, resulting in high impact to confidentiality, integrity, and availability of the affected system.
Chrome Stable Channel Update 116.0.5845.96 addresses the flaw, and downstream distributions such as Fedora and Gentoo have issued corresponding package updates that pull in the patched Chromium build. Security advisories recommend immediate upgrade to the fixed version as the primary mitigation.
The EPSS score reached a peak of 0.6725 with a current value of 0.5897, indicating sustained moderate exploitation interest after disclosure. No public reports of in-the-wild exploitation have been noted in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54221
Vulnerability details
Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Directly implements checks on information inputs to reject invalid data before processing.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.