What is CVE-2019-18893?

CVE-2019-18893 is a medium-severity vulnerability in Avast Secure Browser, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-01-13.

How severe is CVE-2019-18893?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Avast Secure Browser

CVE-2019-18893

XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension, it is granted a very wide set of privileges and can for example access cookies and browsing history, spy on the user while they are surfing the web, and alter their surfing experience in almost arbitrary ways.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.018 (75.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Avast Secure_browser — versions 77.1.1831.91
Avg Secure_browser — versions 77.0.1790.77
Video_downloader_project Video_downloader
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2019-18893?: CVE-2019-18893 is a medium-severity vulnerability in Avast Secure Browser, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2020-01-13.
How severe is CVE-2019-18893?: Medium severity. CVSS v3 base score is 6.1 out of 10.