CVE-2011-2344
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when...
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
Exploit likelihood
What each source reports
NVD Score used
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
- Record
CVE-2011-2344- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
- Record
CVE-2011-2344- Updated
- 2026-11-02
EUVDEUVD-2011-2333 No score
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
- Record
EUVD-2011-2333- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cgm5-64xg-7qqq No score
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when...
Android Picasa in Android 3.0 and 2.x through 2.3.4 uses a cleartext HTTP session when transmitting the authToken obtained from ClientLogin, which allows remote attackers to gain privileges and access private pictures and web albums by sniffing the token from connections with picasaweb.google.com.
- Record
GHSA-cgm5-64xg-7qqq- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2344 is a high vulnerability (CVSS 10.0) in Google Android, published July 8, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.15%, the 66th percentile. No source names a fixed version.
References
android.git.kernel.org?p=platform/packages/apps/Gallery3D.git%3Ba=commit%3Bh=9a418de454e5ce078c98f41b5c18e3bb9175bd20
uni-ulm.de/en/in/mi/staff/koenings/catching-authtokens.html
nvd.nist.gov/vuln/detail/CVE-2011-2344
github.com/advisories/GHSA-cgm5-64xg-7qqq