Vulnerability in Microsoft Windows
CVE-2021-1073
NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of the user login session, leading to the possibility that the user’s account is compromised. This may lead to the targeted user’s data being accessed, altered, or lost.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.3 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Microsoft Windows
- NVIDIA Geforce Experience
- NVIDIA Geforce Experience Software — versions All versions prior to 3.23
References
- nvidia.custhelp.com/app/answers/detail/a_id/5199 (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-1073?
- CVE-2021-1073 is a high-severity vulnerability in Microsoft Windows. CVSS score: 8.3/10. Published 2021-06-25.
- How severe is CVE-2021-1073?
- High severity. CVSS v3 base score is 8.3 out of 10.