CVE-2017-14582

Опубликовано: 30 сент. 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.

Ссылки

http://www.securityfocus.com/bid/101091
Third Party Advisory
VDB Entry
https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/
Third Party Advisory
http://www.securityfocus.com/bid/101091
Third Party Advisory
VDB Entry
https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:zohocorp:site24x7_mobile_network_poller:*:*:*:*:*:android:*:*

Версия до 1.1.4 (включая)

EPSS

Процентиль: 46%

0.00237

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-g7jv-pwgr-pp8c