CWE Code: 310
Vulnerability Type: privilege_escalation
CVSS Score: 10.0
CWE Name:  Cryptographic Issues
Summary: android picasa in android 3.0 and 2.x through 2.3.4 uses a cleartext http session when transmitting the authtoken obtained from clientlogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2011-07-08
Last Modified Date: 2011-07-08