CVE-2013-3587

Summary

The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.

Affected Software

VendorProductVersion RangeStatus
n/aHTTPS protocolallaffected

Weaknesses

  • Other

ADP Enrichment

CVE Program Container

Additional References

References