---
cve: "CVE-2023-0704"
severity: "MEDIUM"
cvss: 6.5
epss: "1%"
vendor: "Google"
kev: false
exploited: false
published: "2023-02-07 21:15:09"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T00:20:57+01:00"
---

# CVE-2023-0704

> 6.5 MEDIUM

## Beschreibung

Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy and proxy settings via a crafted HTML page. (Chromium security severity: Low)

## CNA-Record (Kanon, cvelistV5)

- CNA: **Chrome**
- State: PUBLISHED
- Stand: 2025-03-20 20:53:15

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Keine | good |

## Schwachstellen-Klasse

- **CWE-602** — Client-Side Enforcement of Server-Side Security
  The product includes a server that relies on the client to implement a protection mechanism that is intended to protect the server.

## Angriffsmuster (CAPEC)

- [CAPEC-21 — Exploitation of Trusted Identifiers](https://capec.mitre.org/data/definitions/21.html) _(Severity: High)_
- [CAPEC-31 — Accessing/Intercepting/Modifying HTTP Cookies](https://capec.mitre.org/data/definitions/31.html) _(Severity: High)_
- [CAPEC-162 — Manipulating Hidden Fields](https://capec.mitre.org/data/definitions/162.html) _(Severity: High)_
- [CAPEC-202 — Create Malicious Client](https://capec.mitre.org/data/definitions/202.html) _(Severity: Medium)_
- [CAPEC-207 — Removing Important Client Functionality](https://capec.mitre.org/data/definitions/207.html) _(Severity: High)_
- [CAPEC-208 — Removing/short-circuiting 'Purse' logic: removing/mutating 'cash' decrements](https://capec.mitre.org/data/definitions/208.html) _(Severity: Medium)_
- [CAPEC-383 — Harvesting Information via API Event Monitoring](https://capec.mitre.org/data/definitions/383.html) _(Severity: Low)_
- [CAPEC-384 — Application API Message Manipulation via Man-in-the-Middle](https://capec.mitre.org/data/definitions/384.html) _(Severity: Low)_

## ATT&CK-Techniken

- [T1134 — Access Token Manipulation](https://attack.mitre.org/techniques/T1134/)
- [T1528 — Steal Application Access Token](https://attack.mitre.org/techniques/T1528/)
- [T1539 — Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539/)
- [T1056.004 — Input Capture: Credential API Hooking](https://attack.mitre.org/techniques/T1056/004/)

## BSI-Hinweise (deutsch)

- [Google Chrome und Microsoft Edge: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2023-0302) — _BSI-Einstufung: hoch_
  Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome und Microsoft Edge ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

## Referenzen

- <https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html>
- <https://crbug.com/1385982>
- <https://security.gentoo.org/glsa/202309-17>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2023-0704/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_