PT-2017-15704 · Pandora · Pandora Ios App

Will Dormann · Publicado 2017-12-15 · Atualizado 2019-10-09 · CVE-2017-3194

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pandora iOS app versions prior to 8.3.2

Description The issue is related to the failure of the Pandora iOS app to properly validate SSL certificates provided by HTTPS connections. This failure may enable an attacker to conduct man-in-the-middle (MITM) attacks.

Recommendations For versions prior to 8.3.2, update to version 8.3.2 or later to resolve the issue.

Correção

Information Disclosure

Improper Certificate Validation

Enumeração de Fraquezas

CWE-200

CWE-295

Identificadores relacionados

CVE-2017-3194

Produtos afetados

Pandora Ios App

Referências · 6

• http://securityfocus.com/bid/97158 · Nota
• https://exchange.xforce.ibmcloud.com/collection/XFTAS-Daily-Threat-Assessment-for-March-29-2017-0d704f6eb8163d995bbaf57bbf35a018 · Nota
• https://kb.cert.org/vuls/id/342303 · Nota
• https://scmagazine.com/pandora-apple-app-vulnerable-to-mitm-attacks/article/647106 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-3194 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-3194 · Aviso do Fabricante