CVE-2018-6018

Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic

published January 24, 2018

CVSS
—
EPSS
1%
Percentile
61.5
In the wild
Unconfirmed
What it is

⚠️ Fixed sizes of HTTPS responses in Tinder's iOS and Android apps could leave your private messages exposed! 😱 Think of it like a restaurant menu that only lists the names of dishes without any prices or descriptions. If a sneaky diner listens in on your order, they can figure out what you're having without needing to know the details—quite the privacy breach, right? An attacker sniffing the network traffic could intercept sensitive information, potentially leading to unauthorized access to your private chats and personal data. Imagine someone having the power to eavesdrop on intimate conversations—yikes!

Put simply

Think of it like a restaurant menu that only lists the names of dishes without any prices or descriptions. If a sneaky diner listens in on your order, they can figure out what you're having without needing to know the details—quite the privacy breach, right? This vulnerability arises from the fixed response sizes in the Tinder app, which could allow attackers to exploit the predictable traffic patterns and extract sensitive information through network eavesdropping.

What to do

An attacker sniffing the network traffic could intercept sensitive information, potentially leading to unauthorized access to your private chats and personal data. Imagine someone having the power to eavesdrop on intimate conversations—yikes! To secure your data, ensure you update the Tinder app to the latest version, where this issue has been addressed. Additionally, consider using a VPN when accessing sensitive apps over public Wi-Fi. 🔒 You've got this! Stay vigilant and protect your data like the security superhero you are! 🦸‍♂️🦸‍♀️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00969 · 61.5th percentile
Published
2018-01-24T15:00Z
EPSS history
Timeline
  • 24 JAN 15:00Z
    Fixed sizes of HTTPS responses in Tinder iOS app and Tinder Android app allow an attacker to extract private sensitive information by sniffing network traffic
    cvelistv5