PT-2017-15700 · Flash Seats · Flash Seats Mobile App For Android+1

Ronjor · Publicado 2017-12-15 · Atualizado 2019-10-09 · CVE-2017-3190

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flash Seats Mobile App for Android versions 1.7.9 and earlier Flash Seats Mobile App for iOS versions 1.9.51 and earlier

Description The issue is related to the failure of the Flash Seats Mobile App to properly validate SSL certificates provided by HTTPS connections. This failure may enable an attacker to conduct man-in-the-middle (MITM) attacks.

Recommendations For Android versions 1.7.9 and earlier, update to a version that properly validates SSL certificates. For iOS versions 1.9.51 and earlier, update to a version that properly validates SSL certificates.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-3190

Produtos afetados

Flash Seats Mobile App For Android

Flash Seats Mobile App For Ios

Referências · 5

• https://kb.cert.org/vuls/id/247016 · Nota
• http://securityfocus.com/bid/96719 · Nota
• https://osv.dev/vulnerability/CVE-2017-3190 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3190 · Nota de Segurança
• https://wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553 · Nota