Common Weakness Enumeration

CWE-295

Allowed

Improper Certificate Validation

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not validate, or incorrectly validates, a certificate.

1917 vulnerabilities reference this CWE, most recent first.

GHSA-8JC9-JHMW-R737

Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2024-04-04 05:31
VLAI
Details

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)

Severity
8.3 (High)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-32748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-30T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure\u2122 Cybersecurity Admin Expert (CAE) (Versions prior to 2.2)",
  "id": "GHSA-8jc9-jhmw-r737",
  "modified": "2024-04-04T05:31:59Z",
  "published": "2023-07-06T19:24:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32748"
    },
    {
      "type": "WEB",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-165-08_Cybersecurity_Admin_Expert_Security_Notification.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8JGF-23Q5-X7XX

Vulnerability from github – Published: 2026-06-26 22:50 – Updated: 2026-06-30 17:16
VLAI
Summary
ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass
Details

Summary

ExAws.SNS.verify_message/1 fetches the signing certificate from the SigningCertURL field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls verify_message/1 can supply an attacker-controlled SigningCertURL, sign a forged SNS message with their own RSA key, and cause the function to return :ok, completely bypassing SNS signature verification.

Details

In lib/ex_aws/sns.ex (lines 475–483), verify_message/1 performs three checks: validate_message_params/1 (confirms required fields are present), validate_signature_version/1 (confirms SignatureVersion == "1"), then signature verification. The signature step calls ExAws.SNS.PublicKeyCache.get(message["SigningCertURL"]) and passes the result to :public_key.verify/4.

Neither validate_message_params/1 nor any other step checks that SigningCertURL is an HTTPS URL or that the hostname matches the expected pattern (e.g. sns.<region>.amazonaws.com). PublicKeyCache.get/1 in lib/ex_aws/sns/public_key_cache.ex fetches whatever URL is provided and caches the certificate. The RSA signature then verifies against the attacker's own public key, and verify_message/1 returns :ok.

PoC

  1. Generate an RSA keypair and host the DER/PEM public certificate at any URL reachable from the target server (e.g. http://attacker.example/cert.pem).
  2. Build a forged Notification payload with an arbitrary TopicArn and Message, compute the canonical string-to-sign per the SNS spec, and sign it with the attacker private key.
  3. Set SigningCertURL to the attacker URL and Signature to the base64-encoded signature.
  4. POST the forged payload to any SNS webhook endpoint that calls ExAws.SNS.verify_message/1.
  5. The function returns :ok; the application treats the message as authentic.

Configurations

The application must expose an HTTP endpoint that calls ExAws.SNS.verify_message/1 on incoming request bodies (the standard SNS webhook pattern).

Impact

Complete SNS signature authentication bypass. Affects ex_aws_sns from 2.0.1 through 2.3.4. Consequences include spoofing arbitrary Notification payloads, auto-confirming attacker-controlled SubscribeURL values to hijack topic delivery, and spoofing UnsubscribeConfirmation to disrupt legitimate subscriptions. No authentication or special configuration on the attacker side is required. CVSS v4.0: 8.7 (HIGH).

Resources

  • Introduction commit: https://github.com/ex-aws/ex_aws_sns/commit/a7ec21880943f4dac1d59bda557db0ffcd2b61fa
  • Patch commit: https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "ex_aws_sns"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.1"
            },
            {
              "fixed": "2.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-26T22:50:27Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\n`ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without validating that the URL uses HTTPS or that its host is an AWS-owned SNS certificate domain. An unauthenticated attacker who can POST to any endpoint that calls `verify_message/1` can supply an attacker-controlled `SigningCertURL`, sign a forged SNS message with their own RSA key, and cause the function to return `:ok`, completely bypassing SNS signature verification.\n\n### Details\n\nIn `lib/ex_aws/sns.ex` (lines 475\u2013483), `verify_message/1` performs three checks: `validate_message_params/1` (confirms required fields are present), `validate_signature_version/1` (confirms `SignatureVersion == \"1\"`), then signature verification. The signature step calls `ExAws.SNS.PublicKeyCache.get(message[\"SigningCertURL\"])` and passes the result to `:public_key.verify/4`.\n\nNeither `validate_message_params/1` nor any other step checks that `SigningCertURL` is an HTTPS URL or that the hostname matches the expected pattern (e.g. `sns.\u003cregion\u003e.amazonaws.com`). `PublicKeyCache.get/1` in `lib/ex_aws/sns/public_key_cache.ex` fetches whatever URL is provided and caches the certificate. The RSA signature then verifies against the attacker\u0027s own public key, and `verify_message/1` returns `:ok`.\n\n### PoC\n\n1. Generate an RSA keypair and host the DER/PEM public certificate at any URL reachable from the target server (e.g. `http://attacker.example/cert.pem`).\n2. Build a forged `Notification` payload with an arbitrary `TopicArn` and `Message`, compute the canonical string-to-sign per the SNS spec, and sign it with the attacker private key.\n3. Set `SigningCertURL` to the attacker URL and `Signature` to the base64-encoded signature.\n4. POST the forged payload to any SNS webhook endpoint that calls `ExAws.SNS.verify_message/1`.\n5. The function returns `:ok`; the application treats the message as authentic.\n\n### Configurations\n\nThe application must expose an HTTP endpoint that calls `ExAws.SNS.verify_message/1` on incoming request bodies (the standard SNS webhook pattern).\n\n### Impact\n\nComplete SNS signature authentication bypass. Affects `ex_aws_sns` from 2.0.1 through 2.3.4. Consequences include spoofing arbitrary `Notification` payloads, auto-confirming attacker-controlled `SubscribeURL` values to hijack topic delivery, and spoofing `UnsubscribeConfirmation` to disrupt legitimate subscriptions. No authentication or special configuration on the attacker side is required. CVSS v4.0: **8.7 (HIGH)**.\n\n## Resources\n\n* Introduction commit: https://github.com/ex-aws/ex_aws_sns/commit/a7ec21880943f4dac1d59bda557db0ffcd2b61fa\n* Patch commit: https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48",
  "id": "GHSA-8jgf-23q5-x7xx",
  "modified": "2026-06-30T17:16:17Z",
  "published": "2026-06-26T22:50:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/benoitc/hackney/security/advisories/GHSA-jq4m-q6p2-8gwc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ex-aws/ex_aws_sns/security/advisories/GHSA-8jgf-23q5-x7xx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47074"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ex-aws/ex_aws_sns/commit/1853d280b152d10384a1e21a22cf22152a60be48"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ex-aws/ex_aws_sns"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47074"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass"
}

GHSA-8JGR-9GC8-M8FM

Vulnerability from github – Published: 2022-05-19 00:00 – Updated: 2022-05-28 00:00
VLAI
Details

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-22787"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-18T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.",
  "id": "GHSA-8jgr-9gc8-m8fm",
  "modified": "2022-05-28T00:00:27Z",
  "published": "2022-05-19T00:00:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22787"
    },
    {
      "type": "WEB",
      "url": "https://explore.zoom.us/en/trust/security/security-bulletin"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8JMM-3XWX-W974

Vulnerability from github – Published: 2026-02-04 18:41 – Updated: 2026-02-04 21:56
VLAI
Summary
Alist has Insecure TLS Config
Details

Summary

The application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

Details

Certificate verification is disabled by default for all storage driver communications.

The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/config.go.

func DefaultConfig() *Config {
    // ...
    TlsInsecureSkipVerify: true,
    // ...
}

This vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings.

PoC

The /etc/hosts file was modified to simulate DNS hijacking and redirect www.weiyun.com to a malicious TLS-enabled HTTP server.

The purpose of this Proof of Concept is to demonstrate that the Alist server will establish communication with a malicious server due to disabled certificate verification. This allows interception and theft of authentication cookies used for communicating with other storage providers.

Video

Setup a malicious https server:

ssl.conf:

LoadModule ssl_module modules/mod_ssl.so
LoadModule log_config_module modules/mod_log_config.so

Listen 443

LogFormat "%h %l %u %t \"%r\" %>s %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i" headers
CustomLog "/usr/local/apache2/logs/headers.log" headers

<VirtualHost _default_:443>
    DocumentRoot "/usr/local/apache2/htdocs"
    ServerName localhost

    SSLEngine on
    SSLCertificateFile "/usr/local/apache2/conf/server.crt"
    SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

    ErrorLog "/usr/local/apache2/logs/ssl_error.log"

    <Directory "/usr/local/apache2/htdocs">
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

Dockerfile:

FROM httpd:2.4

# Copy SSL config
COPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf

# Include SSL config in main httpd.conf
RUN echo "Include conf/extra/ssl.conf" >> /usr/local/apache2/conf/httpd.conf

# Copy certs
COPY certs/server.crt /usr/local/apache2/conf/server.crt
COPY certs/server.key /usr/local/apache2/conf/server.key

Scripts to run https server:

mkdir certs
openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout certs/server.key \
  -out certs/server.crt
docker build -t httpd-ssl .
docker run -dit --name my-https-server httpd-ssl
Run alist
docker run -d --restart=unless-stopped -v /etc/alist:/opt/alist/data -p 5244:5244 -e PUID=0 -e PGID=0 -e UMASK=022 --name="alist" alist666/alist:latest

Simulate DNS hijacking: Modify container's /etc/hosts to redirect www.weiyun.com to malicious server

<IP of HTTPS Server>      www.weiyun.com

In the front end, add a weiyun storage and inspect log on tls server:

root@f6d0f5bebe60:/usr/local/apache2# cat /usr/local/apache2/logs/headers.log
172.17.0.3 - - [30/Oct/2025:03:52:58 +0000] "GET /disk HTTP/1.1" 404 196 Host:www.weiyun.com User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Referer:- Accept:- Cookie:WhatEverSecret=

Note that the cookie is in the log.

Impact

This misconfiguration allows attackers to perform man in the middle attack, which potentially leads to the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.

This vulnerability affects all alist deployment.

Credit

This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab - Atuin Automated Vulnerability Discovery Engine

If there are any questions regarding the vulnerability details, please feel free to reach out for further discussion at xlabai@tencent.com.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/alist-org/alist/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.57.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-04T18:41:26Z",
    "nvd_published_at": "2026-02-04T20:16:06Z",
    "severity": "CRITICAL"
  },
  "details": "### Summary\nThe application disables TLS certificate verification by default for all outgoing storage driver communications, making the system vulnerable to Man-in-the-Middle (MitM) attacks. This enables the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.\n\n### Details\nCertificate verification is disabled by default for all storage driver communications.\n\nThe `TlsInsecureSkipVerify` setting is default to true in the `DefaultConfig()` function in [internal/conf/config.go](https://github.com/AlistGo/alist/blob/b4d9beb49cba399842a54fcc33bc95a4a09b7bd4/internal/conf/config.go#L159).\n\n~~~go\nfunc DefaultConfig() *Config {\n    // ...\n    TlsInsecureSkipVerify: true,\n    // ...\n}\n~~~\n\nThis vulnerability enables Man-in-the-Middle (MitM) attacks by disabling TLS certificate verification, allowing attackers to intercept and manipulate all storage communications. Attackers can exploit this through network-level attacks like ARP spoofing, rogue Wi-Fi access points, or compromised internal network equipment to redirect traffic to malicious endpoints. Since certificate validation is skipped, the system will unknowingly establish encrypted connections with attacker-controlled servers, enabling full decryption, data theft, and manipulation of all storage operations without triggering any security warnings. \n\n\n\n#### PoC\nThe /etc/hosts file was modified to simulate DNS hijacking and redirect www.weiyun.com to a malicious TLS-enabled HTTP server.\n\nThe purpose of this Proof of Concept is to demonstrate that the Alist server will establish communication with a malicious server due to disabled certificate verification. This allows interception and theft of authentication cookies used for communicating with other storage providers.\n\n[Video](https://github.com/user-attachments/assets/5b042db0-d830-41d9-9cec-d2ba677ac53d)\n\n\n\n##### Setup a malicious https server:\n\nssl.conf:\n~~~\nLoadModule ssl_module modules/mod_ssl.so\nLoadModule log_config_module modules/mod_log_config.so\n\nListen 443\n\nLogFormat \"%h %l %u %t \\\"%r\\\" %\u003es %b Host:%{Host}i User-Agent:%{User-Agent}i Referer:%{Referer}i Accept:%{Accept}i Cookie:%{Cookie}i\" headers\nCustomLog \"/usr/local/apache2/logs/headers.log\" headers\n\n\u003cVirtualHost _default_:443\u003e\n    DocumentRoot \"/usr/local/apache2/htdocs\"\n    ServerName localhost\n\n    SSLEngine on\n    SSLCertificateFile \"/usr/local/apache2/conf/server.crt\"\n    SSLCertificateKeyFile \"/usr/local/apache2/conf/server.key\"\n\n    ErrorLog \"/usr/local/apache2/logs/ssl_error.log\"\n\n    \u003cDirectory \"/usr/local/apache2/htdocs\"\u003e\n        Options Indexes FollowSymLinks\n        AllowOverride None\n        Require all granted\n    \u003c/Directory\u003e\n\u003c/VirtualHost\u003e\n~~~\n\nDockerfile:\n~~~\nFROM httpd:2.4\n\n# Copy SSL config\nCOPY ssl.conf /usr/local/apache2/conf/extra/ssl.conf\n\n# Include SSL config in main httpd.conf\nRUN echo \"Include conf/extra/ssl.conf\" \u003e\u003e /usr/local/apache2/conf/httpd.conf\n\n# Copy certs\nCOPY certs/server.crt /usr/local/apache2/conf/server.crt\nCOPY certs/server.key /usr/local/apache2/conf/server.key\n~~~\n\nScripts to run https server:\n\n~~~bash\nmkdir certs\nopenssl req -x509 -nodes -days 365 \\\n  -newkey rsa:2048 \\\n  -keyout certs/server.key \\\n  -out certs/server.crt\ndocker build -t httpd-ssl .\ndocker run -dit --name my-https-server httpd-ssl\n~~~\n\n##### Run alist\n~~~bash\ndocker run -d --restart=unless-stopped -v /etc/alist:/opt/alist/data -p 5244:5244 -e PUID=0 -e PGID=0 -e UMASK=022 --name=\"alist\" alist666/alist:latest\n~~~\n\nSimulate DNS hijacking: Modify container\u0027s /etc/hosts to redirect www.weiyun.com to malicious server\n~~~\n\u003cIP of HTTPS Server\u003e      www.weiyun.com\n~~~\n\nIn the front end, add a weiyun storage and inspect log on tls server:\n~~~\nroot@f6d0f5bebe60:/usr/local/apache2# cat /usr/local/apache2/logs/headers.log\n172.17.0.3 - - [30/Oct/2025:03:52:58 +0000] \"GET /disk HTTP/1.1\" 404 196 Host:www.weiyun.com User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Referer:- Accept:- Cookie:WhatEverSecret=\n~~~\n\nNote that the cookie is in the log.\n\n### Impact\nThis misconfiguration allows attackers to perform man in the middle attack, which potentially leads to the complete decryption, theft, and manipulation of all data transmitted during storage operations, severely compromising the confidentiality and integrity of user data.\n\nThis vulnerability affects all alist deployment.\n\n### Credit\nThis vulnerability was discovered by:\n- XlabAI Team of Tencent Xuanwu Lab\n- Atuin Automated Vulnerability Discovery Engine\n\nIf there are any questions regarding the vulnerability details, please feel free to reach out for further discussion at xlabai@tencent.com.",
  "id": "GHSA-8jmm-3xwx-w974",
  "modified": "2026-02-04T21:56:50Z",
  "published": "2026-02-04T18:41:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/AlistGo/alist/security/advisories/GHSA-8jmm-3xwx-w974"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25160"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AlistGo/alist/commit/69629ca76a8f2c8c973ede3b616f93aa26ff23fb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/AlistGo/alist"
    },
    {
      "type": "WEB",
      "url": "https://github.com/AlistGo/alist/releases/tag/v3.57.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Alist has Insecure TLS Config"
}

GHSA-8JQ4-569V-M5W2

Vulnerability from github – Published: 2022-05-14 02:57 – Updated: 2025-04-20 03:39
VLAI
Details

The "First Citizens Bank-Mobile Banking" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Severity
5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-9577"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-06-16T12:29:00Z",
    "severity": "MODERATE"
  },
  "details": "The \"First Citizens Bank-Mobile Banking\" by First Citizens Bank (AL) app 3.0.0 -- aka first-citizens-bank-mobile-banking/id566037101 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
  "id": "GHSA-8jq4-569v-m5w2",
  "modified": "2025-04-20T03:39:12Z",
  "published": "2022-05-14T02:57:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9577"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8M82-P7M3-CC92

Vulnerability from github – Published: 2022-05-24 17:32 – Updated: 2023-01-09 18:30
VLAI
Details

A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-9868"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-22T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate.",
  "id": "GHSA-8m82-p7m3-cc92",
  "modified": "2023-01-09T18:30:24Z",
  "published": "2022-05-24T17:32:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9868"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT211288"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT211289"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT211290"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT211291"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8MJQ-6F3X-GXXR

Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30
VLAI
Details

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-40744"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-11-11T21:15:37Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in Solid Edge SE2025 (All versions \u003c V225.0 Update 11). Affected applications do not properly validate client certificates to connect to License Service endpoint. This could allow an unauthenticated remote attacker to perform man in the middle attacks.",
  "id": "GHSA-8mjq-6f3x-gxxr",
  "modified": "2025-11-11T21:30:28Z",
  "published": "2025-11-11T21:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40744"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-522291.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8MM2-M98W-C7QJ

Vulnerability from github – Published: 2022-05-13 01:33 – Updated: 2022-05-13 01:33
VLAI
Details

IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598.

Severity
5.9 (Medium)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-1543"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-06-27T18:29:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM WebSphere MQ 8.0 and 9.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 142598.",
  "id": "GHSA-8mm2-m98w-c7qj",
  "modified": "2022-05-13T01:33:09Z",
  "published": "2022-05-13T01:33:09Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1543"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/142598"
    },
    {
      "type": "WEB",
      "url": "http://www.ibm.com/support/docview.wss?uid=swg22016346"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8MX3-GP3P-VGG7

Vulnerability from github – Published: 2022-05-24 22:00 – Updated: 2023-07-14 21:20
VLAI
Summary
kevinsawicki/http-request Missing certificate validation
Details

OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.github.kevinsawicki:http-request"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-1010206"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-11-03T23:47:08Z",
    "nvd_published_at": "2019-07-23T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.",
  "id": "GHSA-8mx3-gp3p-vgg7",
  "modified": "2023-07-14T21:20:28Z",
  "published": "2022-05-24T22:00:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010206"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kevinsawicki/http-request/blob/master/lib/src/main/java/com/github/kevinsawicki/http/HttpRequest.java"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kevinsawicki/http-request Missing certificate validation"
}

GHSA-8PH9-X262-CCHW

Vulnerability from github – Published: 2022-05-14 02:41 – Updated: 2025-04-09 04:00
VLAI
Details

The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Severity
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2008-4989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-11-13T01:00:00Z",
    "severity": "MODERATE"
  },
  "details": "The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).",
  "id": "GHSA-8ph9-x262-cchw",
  "modified": "2025-04-09T04:00:34Z",
  "published": "2022-05-14T02:41:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4989"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46482"
    },
    {
      "type": "WEB",
      "url": "https://issues.rpath.com/browse/RPL-2886"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11650"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/678-1"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00222.html"
    },
    {
      "type": "WEB",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00293.html"
    },
    {
      "type": "WEB",
      "url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215"
    },
    {
      "type": "WEB",
      "url": "http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32619"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32681"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32687"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32879"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33501"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/33694"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/35423"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-200901-10.xml"
    },
    {
      "type": "WEB",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1"
    },
    {
      "type": "WEB",
      "url": "http://wiki.rpath.com/Advisories:rPSA-2008-0322"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2009/dsa-1719"
    },
    {
      "type": "WEB",
      "url": "http://www.gnu.org/software/gnutls/security.html"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:227"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2008-0982.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/498431/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/32232"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id?1021167"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/usn-678-2"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2008/3086"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2009/1567"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design Implementation

Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

Mitigation
Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

CAPEC-459: Creating a Rogue Certification Authority Certificate

An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.

CAPEC-475: Signature Spoofing by Improper Validation

An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

← Back to the CWE list