CVE-2017-9245

Опубликовано: 19 июл. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack of SSL.

Ссылки

http://seclists.org/fulldisclosure/2017/Jul/36
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/99892
Third Party Advisory
VDB Entry
https://wwws.nightwatchcybersecurity.com/2017/07/18/advisory-googles-android-news-and-weather-app-doesnt-always-use-ssl-cve-2017-9245/
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jul/36
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/99892
Third Party Advisory
VDB Entry
https://wwws.nightwatchcybersecurity.com/2017/07/18/advisory-googles-android-news-and-weather-app-doesnt-always-use-ssl-cve-2017-9245/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:google:news_and_weather:*:*:*:*:*:android:*:*

Версия до 3.3.1 (исключая)

EPSS

Процентиль: 80%

0.01316

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

GHSA-vpcf-wg24-6v7h