CVEvulnerability
CVE-2011-2344
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2011-07-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-310
Description
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
Affected configurations
• google android 2.1
• google android 2.2
• google android 2.2.1
• google android 2.2.2
• google android 2.3
• google android 2.3.3
• google android 2.3.4
• google android 3.0
Related
Weakness · not in database (1)
References
- http://android.git.kernel.org/?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=7a763db1c15bb6436be85a3f23382e4171970b6e android.git.kernel.org
- http://android.git.kernel.org/?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=9a418de454e5ce078c98f41b5c18e3bb9175bd20 android.git.kernel.org
- http://www.uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html www.uni-ulm.de
- http://android.git.kernel.org/?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=7a763db1c15bb6436be85a3f23382e4171970b6e android.git.kernel.org
- http://android.git.kernel.org/?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=9a418de454e5ce078c98f41b5c18e3bb9175bd20 android.git.kernel.org
- http://www.uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html www.uni-ulm.de