CVE-2015-1229 describes a vulnerability in Google Chrome versions prior to 41.0.2272.76, specifically within the net/http/proxy_client_socket.cc component. This flaw allows remote proxy servers to perform cookie-injection attacks. The vulnerability arises when Chrome improperly handles a 407 Proxy Authentication Required HTTP status code if it is accompanied by a Set-Cookie header in the proxy's response. The CVSS score of 5.0 indicates a medium severity vulnerability. It has a network attack vector and low attack complexity, requiring no authentication. The potential impact is limited to integrity, specifically cookie injection, with no confidentiality or availability impact. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are extremely low, suggesting minimal public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | ||
14.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* | ||
<= 40.0.2214.115CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop_supplementary:6.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.