CVE-2013-0240

GNOME Online Accounts < 3.6.3/3.7.5 MiTM Credential Exposure via SSL Bypass

Title source: llm
STIX 2.1

Description

Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.

References (10)

Core 10
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51976
Various Sources vendor-advisory x_refsource_ubuntu
http://ubuntu.com/usn/usn-1779-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/52791
Issue Tracking x_refsource_confirm
https://bugzilla.gnome.org/show_bug.cgi?id=693214
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=894352
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html

Scores

EPSS 0.0048
EPSS Percentile 65.1%

Details

CWE
CWE-310
Status published
Products (12)
canonical/ubuntu_linux 11.10
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 12.10
gnome/gnome_online_accounts 3.4.0
gnome/gnome_online_accounts 3.4.1
gnome/gnome_online_accounts 3.6.0
gnome/gnome_online_accounts 3.6.1
gnome/gnome_online_accounts 3.6.2
gnome/gnome_online_accounts 3.7.1
gnome/gnome_online_accounts 3.7.2
... and 2 more
Published Apr 02, 2013
Tracked Since Feb 18, 2026