CVE-2013-1799
Last modified
CVE-2013-1799 is a vulnerability of currently unknown severity. Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.. EPSS estimates a 1.03% chance of exploitation in the next 30 days.
Description
Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gnome | Gnome Online Accounts | 3.6.0 |
| Gnome | Gnome Online Accounts | 3.6.1 |
| Gnome | Gnome Online Accounts | 3.6.2 |
| Gnome | Gnome Online Accounts | 3.7.1 |
| Gnome | Gnome Online Accounts | 3.7.2 |
| Gnome | Gnome Online Accounts | 3.7.3 |
| Gnome | Gnome Online Accounts | 3.7.4 |
| Gnome | Gnome Online Accounts | 3.7.90 |
| Canonical | Ubuntu Linux | 11.10 |
| Canonical | Ubuntu Linux | 12.04 |
| Canonical | Ubuntu Linux | 12.10 |
References
- http://secunia.com/advisories/51976Vendor Advisory
- http://secunia.com/advisories/52791Vendor Advisory
- http://secunia.com/advisories/51976Vendor Advisory
- http://secunia.com/advisories/52791Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-1799?
How severe is CVE-2013-1799?
How do I fix CVE-2013-1799?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-1793openstack-utils openstack-db has insecure password creation7.5
- CVE-2013-1794Buffer overflow in certain client utilities in OpenAFS befor…
- CVE-2013-1795Integer overflow in ptserver in OpenAFS before 1.6.2 allows …
- CVE-2013-1796The kvm_set_msr_common function in arch/x86/kvm/x86.c in the…
- CVE-2013-1797Use-after-free vulnerability in arch/x86/kvm/x86.c in the Li…
- CVE-2013-1798The ioapic_read_indirect function in virt/kvm/ioapic.c in th…
- CVE-2013-1800The crack gem 0.3.1 and earlier for Ruby does not properly r…
- CVE-2013-1801The httparty gem 0.9.0 and earlier for Ruby does not properl…
- CVE-2013-1802The extlib gem 0.9.15 and earlier for Ruby does not properly…
- CVE-2013-1803Multiple SQL injection vulnerabilities in PHP-Fusion before …
- CVE-2013-1804Multiple cross-site scripting (XSS) vulnerabilities in PHP-F…
- CVE-2013-1805Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2013-1799?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST