Unscored CVE-2017-9245 EUVD-2017-18182GHSA-vpcf-wg24-6v7h

The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and l…

Published Jul 19, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Description

The Google News and Weather application before 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing the network and leveraging the lack of SSL.

References

https://wwws.nightwatchcybersecurity.com/2017/07/18/advisory-googles-android-news-and-weather-app-doesnt-always-use-ssl-cve-2017-9245/
20170720 Google's Android News and Weather App Doesn't Always Use SSL [CVE-2017-9245] mailing-list
99892 vdb-entry