PT-2018-7241 · Threatmetrix · Threatmetrix Sdk

Will Dormann · Publicado 2018-07-24 · Atualizado 2019-10-09 · CVE-2017-3182

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ThreatMetrix SDK versions prior to 3.2

Description: The issue concerns the failure to validate SSL certificates provided by HTTPS connections, potentially allowing an attacker to perform a man-in-the-middle (MITM) attack. ThreatMetrix is a security library for mobile applications aimed at providing fraud prevention and device identity capabilities. An affected application communicates with "https://h-sdk.online-metrix.net" regardless of the connection's security. This could enable an attacker on the same network or upstream from the iOS device to view or modify ThreatMetrix network traffic that should have been protected by HTTPS.

Recommendations: For ThreatMetrix SDK versions prior to 3.2, update to version 3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the https://h-sdk.online-metrix.net endpoint until the update is applied.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2017-3182

Produtos afetados

Threatmetrix Sdk

Referências · 4

• https://securityfocus.com/bid/95360 · Nota
• https://kb.cert.org/vuls/id/767208 · Nota
• https://osv.dev/vulnerability/CVE-2017-3182 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3182 · Nota de Segurança