« Volver al listado

CVE-2019-18893

Estado: ModificadaMedia (6.1)—

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Avast — Secure BrowserAVG — Secure BrowserVideo Downloader Project — Video Downloader

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-18893",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-13T17:15:11.540",
  "references": [
    {
      "url": "https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://palant.de/2020/01/13/pwning-avast-secure-browser-for-fun-and-profit/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de tipo XSS en el componente Video Downloader versiones anteriores a la versión 1.5 del Avast Secure Browser versión 77.1.1831.91 y AVG Secure Browser versión 77.0.1790.77, permite a los sitios web ejecutar su código en el contexto de este componente. Aunque Video Downloader es técnicamente una extensión del navegador, se le otorga un rango muy amplio de privilegios y puede, por ejemplo, acceder a cookies y al historial de navegación, espiar al usuario mientras navega en la web y alterar su experiencia de navegación en modos casi arbitrarios."
    }
  ],
  "lastModified": "2026-06-17T02:25:32.297",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:avast:secure_browser:77.1.1831.91:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8374E1C8-60CD-4293-AB5B-2217FF68476D"
            },
            {
              "criteria": "cpe:2.3:a:avg:secure_browser:77.0.1790.77:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDFD7A39-B9A0-4D66-80FA-27504D799ECF"
            },
            {
              "criteria": "cpe:2.3:a:video_downloader_project:video_downloader:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9BA8FBA-5001-4AA4-9979-E4ED72839559",
              "versionEndExcluding": "1.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}