CVE-2016-7152
Publicada el · Actualizada el
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 13%
probabilidad de explotación
13%top 4% de las CVE
explotación observada
noninguna fuente lo reporta
The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.
Productos afectados
n/a · n/aReferencias
http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/https://tom.vg/papers/heist_blackhat2016.pdfhttp://www.securityfocus.com/bid/92769http://www.securitytracker.com/id/1036741http://www.securitytracker.com/id/1036742http://www.securitytracker.com/id/1036743http://www.securitytracker.com/id/1036744http://www.securitytracker.com/id/1036745http://www.securitytracker.com/id/1036746