CVE-2016-7153

 

Published at: - 06-09-2016 12:59

Last modified: - 06-10-2022 02:13

Total changes: - 2

Description

The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• https://tom.vg/papers/heist_blackhat2016.pdf
• http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/
• 1036744-
• 92773-
• 1036746-
• 1036745-
• 1036741-
• 1036742-
• 1036743-

 

Keywords

NVD

 

CVE-2016-7153

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures