CVE-2015-0874

Опубликовано: 26 сент. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate.

Ссылки

http://jvn.jp/en/jp/JVN14522790/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000015.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/72597
Third Party Advisory
VDB Entry
http://jvn.jp/en/jp/JVN14522790/index.html
Third Party Advisory
VDB Entry
http://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000015.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/72597
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:okb:smart_passbook:1.0.0:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00497

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-5rxx-pvxx-jw4m