CVEvulnerability
CVE-2017-9245
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-07-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack of SSL.
Affected configurations
• google news and weather (< 3.3.1)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://seclists.org/fulldisclosure/2017/Jul/36 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/99892 Third Party Advisory, VDB Entry
- https://wwws.nightwatchcybersecurity.com/2017/07/18/advisory-googles-android-news-and-weather-app-doesnt-always-use-ssl-cve-2017-9245/ Exploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/Jul/36 Exploit, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/99892 Third Party Advisory, VDB Entry
- https://wwws.nightwatchcybersecurity.com/2017/07/18/advisory-googles-android-news-and-weather-app-doesnt-always-use-ssl-cve-2017-9245/ Exploit, Third Party Advisory