CVE-2013-0240
Last modified
CVE-2013-0240 is a vulnerability of currently unknown severity. Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.. EPSS estimates a 1.36% chance of exploitation in the next 30 days.
Description
Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Gnome Online Accounts | 3.4.0 |
| Gnome | Gnome Online Accounts | 3.4.1 |
| Gnome | Gnome Online Accounts | 3.6.0 |
| Gnome | Gnome Online Accounts | 3.6.1 |
| Gnome | Gnome Online Accounts | 3.6.2 |
| Gnome | Gnome Online Accounts | 3.7.1 |
| Gnome | Gnome Online Accounts | 3.7.2 |
| Gnome | Gnome Online Accounts | 3.7.3 |
| Gnome | Gnome Online Accounts | 3.7.4 |
| Canonical | Ubuntu Linux | 11.10 |
| Canonical | Ubuntu Linux | 12.04 |
| Canonical | Ubuntu Linux | 12.10 |
References
- http://secunia.com/advisories/51976Vendor Advisory
- http://secunia.com/advisories/52791Vendor Advisory
- http://secunia.com/advisories/51976Vendor Advisory
- http://secunia.com/advisories/52791Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-0240?
How severe is CVE-2013-0240?
How do I fix CVE-2013-0240?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-0234Cross-site scripting (XSS) vulnerability in the Twitter widg…
- CVE-2013-0235The XMLRPC API in WordPress before 3.5.1 allows remote attac…
- CVE-2013-0236Multiple cross-site scripting (XSS) vulnerabilities in WordP…
- CVE-2013-0237Cross-site scripting (XSS) vulnerability in Plupload.as in M…
- CVE-2013-0238The try_parse_v4_netmask function in hostmask.c in IRCD-Hybr…
- CVE-2013-0239Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x befor…
- CVE-2013-0241The QXL display driver in QXL Virtual GPU 0.1.0 allows local…
- CVE-2013-0242Buffer overflow in the extend_buffers function in the regula…
- CVE-2013-0243haskell-tls-extra before 0.6.1 has Basic Constraints attribu…7.4
- CVE-2013-0244Cross-site scripting (XSS) vulnerability in Drupal 6.x befor…
- CVE-2013-0245The printer friendly version functionality in the Book modul…
- CVE-2013-0246The Image module in Drupal 7.x before 7.19, when a private f…
Are you affected by CVE-2013-0240?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST