CVE-2024-43201

Опубликовано: 23 сент. 2024

Источник: nvd

CVSS3: 8.8

CVSS3: 5.9

EPSS Низкий

Описание

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).

Ссылки

https://apps.apple.com/us/app/planet-fitness-workouts/id399857015
Product
https://dontvacuum.me/bugs/pf/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:planetfitness:planet_fitness_workouts:*:*:*:*:*:*:*:*

Версия до 9.8.12 (исключая)

Одно из

cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00094

Низкий

8.8 High

CVSS3

5.9 Medium

CVSS3

Дефекты

CWE-295

Связанные уязвимости

GHSA-6r2w-57p9-f5hh

CVSS3: 8.8

github

больше 1 года назад

The Planet Fitness Workouts iOS and Android mobile apps prior to version 9.8.12 (released on 2024-07-25) fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information.

EPSS

Процентиль: 27%

0.00094

Низкий

8.8 High

CVSS3

5.9 Medium

CVSS3

Дефекты

CWE-295