CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1917 vulnerabilities reference this CWE, most recent first.
GHSA-G529-HV2C-7MQF
Vulnerability from github – Published: 2023-08-14 21:30 – Updated: 2024-04-04 06:56In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2023-21265"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-14T21:15:12Z",
"severity": "HIGH"
},
"details": "In multiple locations, there are root CA certificates which need to be disabled. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n",
"id": "GHSA-g529-hv2c-7mqf",
"modified": "2024-04-04T06:56:02Z",
"published": "2023-08-14T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21265"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/system/ca-certificates/+/6065b4a4c7da9cc9ee01c2f6389575647d2724c4"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-08-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G56R-PHRF-6PC4
Vulnerability from github – Published: 2023-04-29 00:30 – Updated: 2023-05-08 18:30HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
{
"affected": [],
"aliases": [
"CVE-2023-31486"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-29T00:15:09Z",
"severity": null
},
"details": "HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.",
"id": "GHSA-g56r-phrf-6pc4",
"modified": "2023-05-08T18:30:16Z",
"published": "2023-04-29T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31486"
},
{
"type": "WEB",
"url": "https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules"
},
{
"type": "WEB",
"url": "https://hackeriet.github.io/cpan-http-tiny-overview"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/04/18/14"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2023/05/03/4"
},
{
"type": "WEB",
"url": "https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/04/29/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/03/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/05/07/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G5XX-F9CV-W25H
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-19 00:01In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06461919; Issue ID: ALPS06461919.
{
"affected": [],
"aliases": [
"CVE-2022-20081"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "MODERATE"
},
"details": "In A-GPS, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06461919; Issue ID: ALPS06461919.",
"id": "GHSA-g5xx-f9cv-w25h",
"modified": "2022-04-19T00:01:20Z",
"published": "2022-04-12T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20081"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/April-2022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G636-WXGP-6G5H
Vulnerability from github – Published: 2022-05-17 02:49 – Updated: 2022-05-17 02:49Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.
{
"affected": [],
"aliases": [
"CVE-2016-1132"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-13T14:59:00Z",
"severity": "HIGH"
},
"details": "Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.",
"id": "GHSA-g636-wxgp-6g5h",
"modified": "2022-05-17T02:49:25Z",
"published": "2022-05-17T02:49:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1132"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN47951769/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000004.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G6X8-5JJ7-QQFV
Vulnerability from github – Published: 2025-07-19 00:32 – Updated: 2025-07-19 00:32A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.
{
"affected": [],
"aliases": [
"CVE-2025-7395"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-18T23:15:23Z",
"severity": "CRITICAL"
},
"details": "A certificate verification error in wolfSSL when building with the WOLFSSL_SYS_CA_CERTS and WOLFSSL_APPLE_NATIVE_CERT_VALIDATION options results in the wolfSSL\n client failing to properly verify the server certificate\u0027s domain name,\n allowing any certificate issued by a trusted CA to be accepted regardless of the hostname.",
"id": "GHSA-g6x8-5jj7-qqfv",
"modified": "2025-07-19T00:32:31Z",
"published": "2025-07-19T00:32:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7395"
},
{
"type": "WEB",
"url": "http://github.com/wolfssl/wolfssl.git"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:D/RE:X/U:Red",
"type": "CVSS_V4"
}
]
}
GHSA-G732-V53W-3QQ2
Vulnerability from github – Published: 2023-05-01 15:30 – Updated: 2024-04-04 03:44A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.
{
"affected": [],
"aliases": [
"CVE-2022-48186"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-01T15:15:09Z",
"severity": "HIGH"
},
"details": "A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.",
"id": "GHSA-g732-v53w-3qq2",
"modified": "2024-04-04T03:44:41Z",
"published": "2023-05-01T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48186"
},
{
"type": "WEB",
"url": "https://iknow.lenovo.com.cn/detail/dc_206093.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G784-X97G-R6WW
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service and payload tampering.
{
"affected": [],
"aliases": [
"CVE-2021-21571"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-24T17:15:00Z",
"severity": "MODERATE"
},
"details": "Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service and payload tampering.",
"id": "GHSA-g784-x97g-r6ww",
"modified": "2022-05-24T19:06:05Z",
"published": "2022-05-24T19:06:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21571"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000188682"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G788-M4V3-47C7
Vulnerability from github – Published: 2024-08-14 18:32 – Updated: 2024-08-14 18:32IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714.
{
"affected": [],
"aliases": [
"CVE-2023-50315"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-14T17:15:14Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714.",
"id": "GHSA-g788-m4v3-47c7",
"modified": "2024-08-14T18:32:41Z",
"published": "2024-08-14T18:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50315"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/274714"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7165511"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G7JV-PWGR-PP8C
Vulnerability from github – Published: 2022-05-17 00:34 – Updated: 2025-04-20 03:46The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.
{
"affected": [],
"aliases": [
"CVE-2017-14582"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-30T01:29:00Z",
"severity": "MODERATE"
},
"details": "The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.",
"id": "GHSA-g7jv-pwgr-pp8c",
"modified": "2025-04-20T03:46:06Z",
"published": "2022-05-17T00:34:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14582"
},
{
"type": "WEB",
"url": "https://wwws.nightwatchcybersecurity.com/2017/09/27/zoho-site24x7-mobile-network-poller-for-android-didnt-properly-validate-ssl-cve-2017-14582"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101091"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G7PG-WJ9C-H3J9
Vulnerability from github – Published: 2022-05-17 00:26 – Updated: 2022-05-17 00:26ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.
{
"affected": [],
"aliases": [
"CVE-2014-3706"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-18T14:29:00Z",
"severity": "MODERATE"
},
"details": "ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.",
"id": "GHSA-g7pg-wj9c-h3j9",
"modified": "2022-05-17T00:26:05Z",
"published": "2022-05-17T00:26:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3706"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1154977"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101507"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.