Skip to main content

Yandex Browser CVE-2024-6473

HIGH
Untrusted Search Path (CWE-426)
2024-09-03 browser-security@yandex-team.ru
Information Disclosure Yandex Browser
8.4
CVSS 4.0 · Vendor: yandex-team
Share

Severity by source

Vendor (yandex-team) PRIMARY
8.4 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (yandex-team) · only source for this CVE.

CVSS VectorVendor: yandex-team

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Sep 03, 2024 - 11:15 cve.org
HIGH 8.4

DescriptionCVE.org

Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.

AnalysisAI

Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-426. Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. Affected products include: Yandex Yandex Browser. Version information: before 24.7.1.380.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Yandex Browser

View all
CVE-2021-25255 HIGH
8.3 May 21

Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. Rated high
CVE-2020-7369 MEDIUM POC
4.3 Oct 20

User Interface (UI) Misrepresentation of Critical Information vulnerability in the address bar of the Yandex Browser all
CVE-2021-25254 HIGH
8.2 May 21

Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. Rated high severity (CVS
CVE-2022-28226 HIGH
7.8 Jun 15

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.801 allows a local, low privileged, attacker
CVE-2022-28225 HIGH
7.8 Jun 15

Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker
CVE-2021-25263 HIGH
7.8 Aug 17

Local privilege vulnerability in Yandex Browser for Windows prior to 21.9.0.390 allows a local, low privileged, attacker
CVE-2023-26226 HIGH
7.4 May 30

A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682. Rated high se
CVE-2016-8503 HIGH
7.3 Oct 26

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 16.7 to 16.9 could be used by remote att
CVE-2016-8502 HIGH
7.3 Oct 26

Yandex Protect Anti-phishing warning in Yandex Browser for desktop from version 15.12.0 to 16.2 could be used by remote

CVE-2021-25262 MEDIUM
6.9 May 21

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. Rated medium
CVE-2016-8507 MEDIUM
6.5 Mar 01

Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remot
CVE-2016-8508 MEDIUM
6.5 Mar 01

Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web

Same weakness CWE-426 – Untrusted Search Path

View all
CVE-2015-0096 CRITICAL POC
9.3
CVE-2012-1854 HIGH POC
7.8
CVE-2016-5330 HIGH POC
7.8
CVE-2019-11660 HIGH POC
7.8
CVE-2017-12414 CRITICAL POC
9.8
CVE-2025-26155 CRITICAL POC
9.8
CVE-2023-30330 CRITICAL POC
9.8
CVE-2023-26036 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-6473 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy