CVE-2011-2344

2022-10-0316:15:18

Chrome

www.cve.org

android

picasa

authtoken

cleartext

vulnerability

transmission

google

6.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.2%

JSON

Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.