CVE-2013-3587

2020-02-2117:11:47

certcc

www.cve.org

AI Score

Confidence

Low

EPSS

0.003

Percentile

71.3%

JSON

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a “BREACH” attack, a different issue than CVE-2012-4929.

CNA Affected

[
  {
    "product": "HTTPS protocol",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "all"
      }
    ]
  }
]