PT-2017-16754 · Dot It · Dot It Banque Zitouna App

Publicado 2017-05-05 · Atualizado 2021-06-01 · CVE-2017-5914

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DOT IT Banque Zitouna app version 2.1 for iOS

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from SSL servers.

Recommendations For DOT IT Banque Zitouna app version 2.1 for iOS, consider implementing certificate verification to prevent man-in-the-middle attacks. As a temporary workaround, restrict the use of the app on unsecured networks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-5914

Produtos afetados

Dot It Banque Zitouna App

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5914 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-5914 · Aviso do Fabricante
• https://t.me/cvenotify/15353 · Publicação no Telegram
• https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f · Nota