CVE-2017-3190

Опубликовано: 16 дек. 2017

Источник: nvd

CVSS3: 7.5

CVSS2: 2.9

EPSS Низкий

Описание

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.

Ссылки

http://www.securityfocus.com/bid/96719
Third Party Advisory
VDB Entry
https://www.kb.cert.org/vuls/id/247016
Third Party Advisory
US Government Resource
https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/
Third Party Advisory
http://www.securityfocus.com/bid/96719
Third Party Advisory
VDB Entry
https://www.kb.cert.org/vuls/id/247016
Third Party Advisory
US Government Resource
https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:axs:flash_seats:*:*:*:*:*:iphone_os:*:*

Версия до 1.9.51 (включая)

Конфигурация 2

cpe:2.3:a:axs:flash_seats:*:*:*:*:*:android:*:*

Версия до 1.7.9 (включая)

EPSS

Процентиль: 27%

0.00097

Низкий

7.5 High

CVSS3

2.9 Low

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-x77c-2rv5-hhqq