Back
CVE-2013-3587
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the…
Medium5.9EPSS 6.0%
- Published
- Updated
- Reserved
- Assigned by
- certcc
Description
The HTTPS protocol, as used in unspecified web applications, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body, aka a "BREACH" attack, a different issue than CVE-2012-4929.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 6.0% · top 6.6% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Weakness
Affected products
HTTPS protocol
- affected all
References (12)
- http://breachattack.com/ (opens in a new tab)x_refsource_MISCx_transferred
- http://security.stackexchange.com/questions/20406/is-http-compression-safe#20407 (opens in a new tab)x_refsource_MISCx_transferred
- http://slashdot.org/story/13/08/05/233216 (opens in a new tab)x_refsource_MISCx_transferred
- http://www.iacr.org/cryptodb/archive/2002/FSE/3091/3091.pdf (opens in a new tab)x_refsource_MISCx_transferred
- https://www.blackhat.com/us-13/briefings.html#Prado (opens in a new tab)x_refsource_MISCx_transferred
- http://github.com/meldium/breach-mitigation-rails (opens in a new tab)x_refsource_MISCx_transferred
- https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/ (opens in a new tab)x_refsource_MISCx_transferred
- http://www.kb.cert.org/vuls/id/987798 (opens in a new tab)x_refsource_MISCx_transferred
- https://hackerone.com/reports/254895 (opens in a new tab)x_refsource_MISCx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=995168 (opens in a new tab)x_refsource_MISCx_transferred
- https://support.f5.com/csp/article/K14634 (opens in a new tab)x_refsource_MISCx_transferred
- [httpd-dev] 20210409 GSOC project Idea- fix for CVE-2013-3587 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2013-3587)Record last updated .