CVE-2021-1073
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of the user login session, leading to the possibility that the user’s account is compromised. This may lead to the targeted user’s data being accessed, altered, or lost.
- CVSS 3.1
- 8.3 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- EPSS
- 0.90% probability · 58th percentile
- CISA KEV
- Not listed
- Affected
- nvidia/geforce experience
- Source
- psirt@nvidia.com
References
- https://nvidia.custhelp.com/app/answers/detail/a_id/5199Vendor Advisory
- https://nvidia.custhelp.com/app/answers/detail/a_id/5199Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.