CVE-2017-3212

Опубликовано: 05 мая 2017

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Ссылки

http://www.kb.cert.org/vuls/id/556600
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/98307
Third Party Advisory
VDB Entry
https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f
http://www.kb.cert.org/vuls/id/556600
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/98307
Third Party Advisory
VDB Entry
https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:sccu:space_coast_credit_union:*:*:*:*:*:android:*:*

Версия до 2.1.0.1104 (включая)

cpe:2.3:a:sccu:space_coast_credit_union:*:*:*:*:*:iphone_os:*:*

Версия до 2.2 (включая)

EPSS

Процентиль: 45%

0.00223

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-6939-j3mf-8m46