PT-2021-13469 · Nvidia · Nvidia Geforce Experience

Published 2021-06-25 · Updated 2022-07-12 · CVE-2021-1073

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NVIDIA GeForce Experience versions prior to 3.23

Description The issue arises when a user attempts to log in to NVIDIA GeForce Experience through a browser while having other web pages open in the same browser. This situation allows a malicious web page to access the user's login session token, potentially compromising the user's account and leading to unauthorized access, alteration, or loss of the user's data. The vulnerability can be exploited if a user clicks on a maliciously formatted link that opens the GeForce Experience login page in a new browser tab, and then enters their login information.

Recommendations For NVIDIA GeForce Experience versions prior to 3.23, update to version 3.23 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the browser to log in to GeForce Experience, and instead use the application directly, until the update is applied. Additionally, users should be cautious when clicking on links from unknown sources and avoid entering login information when prompted by unfamiliar web pages.

Fix

Related Identifiers

CVE-2021-1073

Affected Products

Nvidia Geforce Experience

References · 7

• https://nvidia.custhelp.com/app/answers/detail/a_id/5199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-1073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1073 · Security Note
• https://t.me/cvenotify/16754 · Telegram Post
• https://t.me/cvenotify/16963 · Telegram Post
• https://t.me/cibsecurity/25726 · Telegram Post
• https://t.me/true_secator/1864 · Telegram Post