CVE-2021-1073 Information disclosure in NVIDIA GeForce Experience Software
A vulnerability in NVIDIA GeForce Experience allows malicious web pages to steal login session tokens, potentially leading to account compromise and data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-1073?
CVE-2021-1073 is a high-severity vulnerability in NVIDIA GeForce Experience Software, published on 25 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of the user login session, leading to the possibility that the user’s account is compromised. This may lead to the targeted user’s data being accessed, altered, or lost.
Which versions are affected by CVE-2021-1073?
It affects 1 product.
Products include Nvidia Geforce Experience.
How do I fix CVE-2021-1073?
No fix has been published for CVE-2021-1073 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-1073 being exploited?
There is no known exploitation of CVE-2021-1073 in the wild and no public exploit code.
Other vulnerabilities in NVIDIA GeForce Experience Software
- CVE-2017-6250 Code injection in GeForce Experience
- CVE-2016-8812 Memory corruption in Quadro, NVS, and GeForce (all versions)
- CVE-2022-42291 Path traversal in GeForce Experience
- CVE-2021-23175 Missing authorization in NVIDIA GeForce Experience Software
- CVE-2020-5977 Path traversal in NVIDIA GeForce Experience Software
Sources
Also known as GHSA-4wh7-mq9j-whxw.