CVE-2017-9045

MEDIUM

Google I/O <5.1.4 - Info Disclosure

Title source: llm

Description

The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocks_v4.json file.

References (2)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/98549

[Exploit, Third Party Advisory] https://wwws.nightwatchcybersecurity.com/2017/05/17/advisory-google-io-2017-android-app/

Scores

CVSS v3 5.9

EPSS 0.0009

EPSS Percentile 26.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE

CWE-311

Status published

Products (2)

google/google_i\/o_2017 < 5.0.3

n/a/n/a

Published May 18, 2017

Tracked Since Feb 18, 2026