CVE-2017-9045 The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof F...
MediumCVSS 5.9
EPSS 0.27%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Google I/O 2017 application before 5.1.4 for Android downloads multiple .json files from http://storage.googleapis.com without SSL, which makes it easier for man-in-the-middle attackers to spoof Feed and Schedule data by creating a modified blocks_v4.json file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| google io 2017 | <= 5.0.3 | No fix listed |
References
- 98549 third-party-advisory vdb-entry
- wwws.nightwatchcybersecurity.com exploit third-party-advisory