Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2013-3587
HistoryFeb 21, 2020 - 6:15 p.m.

CVE-2013-3587

2020-02-2118:15:00
CWE-200
[email protected]
web.nvd.nist.gov
711
cve-2013-3587
https
protocol
web applications
breach attack
plaintext
secret values

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.9%

JSON

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a “BREACH” attack, a different issue than CVE-2012-4929.

Related

prion 2
ubuntucve 2
cert 1
hackerone 2
f5 6
openvas 37
ibm 4
nessus 33
ubuntu 3
debian 8
cve 1
threatpost 1
jvn 1
veracode 1
osv 6
debiancve 1
gentoo 2
fedora 3
securityvulns 4
kitploit 1
checkpoint_security 1
centos 1
amazon 1
redhat 3
oraclelinux 5
rosalinux 1
prion
prion
Design/Logic Flaw
2020-02-21 18:15:00
Design/Logic Flaw
2012-09-15 18:55:00
ubuntucve
ubuntucve
CVE-2013-3587
2020-02-21 00:00:00
CVE-2012-4929
2012-09-15 00:00:00
cert
cert
BREACH vulnerability in compressed HTTPS
2013-08-02 00:00:00
hackerone
hackerone
Legal Robot: SSL BREACH attack (CVE-2013-3587)
2017-07-30 08:51:28
Imgur: Big Bug in SSL : breach compression attack (CVE-2013-3587) affect imgur.com
2016-01-19 23:17:28
f5
f5
K14634 : SSL/TLS BREACH vulnerability CVE-2013-3587
2014-11-21 00:00:00
SOL14634 - SSL/TLS BREACH vulnerability CVE-2013-3587
2013-08-22 00:00:00
SOL14054 - CRIME vulnerability via TLS 1.2 protocol CVE-2012-4929
2012-12-05 00:00:00
openvas
openvas
SSL/TLS: BREACH attack against HTTP compression
2021-05-11 00:00:00
Ubuntu Update for openssl USN-1898-1
2013-07-05 00:00:00
Debian Security Advisory DSA 2627-1 (nginx - information leak)
2013-02-17 00:00:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM Jazz Team Server affect IBM Rational products based on IBM Jazz technology
2021-04-28 18:35:50
Security Bulletin: IBM Integrated Management Module II (IMM2) is affected by vulnerability in OpenSSL (CVE-2012-4929)
2020-03-03 19:02:20
Security Bulletin: Storwize V7000 Unified Update Includes Fixes for Multiple Vendor Security Vulnerabilities
2022-09-26 04:23:14
nessus
nessus
Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : openssl vulnerability (USN-1898-1)
2013-07-05 00:00:00
F5 Networks BIG-IP : CRIME vulnerability via TLS 1.2 protocol (K14054)
2014-10-10 00:00:00
openSUSE Security Update : libqt4 (openSUSE-SU-2012:1420-1)
2014-06-13 00:00:00
ubuntu
ubuntu
Qt vulnerability
2012-11-08 00:00:00
OpenSSL vulnerability
2013-07-04 00:00:00
Apache HTTP Server vulnerabilities
2012-11-08 00:00:00
debian
debian
[SECURITY] [DSA 2627-1] nginx security update
2013-02-17 11:14:31
[SECURITY] [DSA 2579-1] apache2 security update
2012-11-30 13:22:52
openssl security update
2014-06-20 16:35:50
cve
cve
CVE-2012-4929
2012-09-15 18:55:00
threatpost
threatpost
Apple Patches Mass of Security Bugs in OS X and Safari
2013-06-05 09:51:54
jvn
jvn
JVN#65273415: Android OS issue where it is affected by the CRIME attack
2016-07-22 00:00:00
veracode
veracode
Information Leakage
2019-01-15 08:58:53
osv
osv
nginx - information leak
2013-02-17 00:00:00
openssl - security update
2014-06-20 00:00:00
lighttpd - several issues
2013-02-17 00:00:00
debiancve
debiancve
CVE-2012-4929
2012-09-15 18:55:00
gentoo
gentoo
nginx: Multiple vulnerabilities
2016-06-17 00:00:00
Apache HTTP Server: Multiple vulnerabilities
2013-09-23 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: mingw-openssl-1.0.1e-1.fc18
2013-04-03 04:51:11
[SECURITY] Fedora 20 Update: Pound-2.6-8.fc20
2014-11-12 02:45:18
[SECURITY] Fedora 19 Update: Pound-2.6-8.fc19
2014-11-07 02:38:03
securityvulns
securityvulns
[SECURITY] [DSA 2579-1] apache2 security update
2012-12-02 00:00:00
Apache security vulnerabilities
2012-12-02 00:00:00
Apple Mac OS X multiple security vulnerabilities
2013-06-17 00:00:00
kitploit
kitploit
Sitadel - Web Application Security Scanner
2019-01-14 12:13:00
checkpoint_security
checkpoint_security
Check Point response to CVE-2012-4929, CVE-2012-4930 aka CRIME attack
2012-10-20 22:00:00
centos
centos
openssl security update
2013-03-04 22:46:45
amazon
amazon
Medium: openssl
2013-03-14 22:04:00
redhat
redhat
(RHSA-2013:0587) Moderate: openssl security update
2013-03-04 00:00:00
(RHSA-2014:0416) Important: rhevm-spice-client security update
2014-04-17 00:00:00
(RHSA-2013:0636) Important: rhev-hypervisor6 security and bug fix update
2013-03-13 00:00:00
oraclelinux
oraclelinux
openssl security update
2013-03-04 00:00:00
openssl-fips security update
2015-04-02 00:00:00
openssl security update
2016-09-27 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2024-2371
2024-03-12 12:37:38

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.9 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

70.9%

JSON
Related for CVE-2013-3587
prion2ubuntucve2cert1hackerone2f56openvas37ibm4nessus33ubuntu3debian8cve1threatpost1jvn1veracode1osv6debiancve1gentoo2fedora3securityvulns4kitploit1checkpoint_security1centos1amazon1redhat3oraclelinux5rosalinux1