PT-2017-15704 · Pandora · Pandora Ios App

Will Dormann · Published 2017-12-15 · Updated 2019-10-09 · CVE-2017-3194

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pandora iOS app versions prior to 8.3.2

Description The issue is related to the failure of the Pandora iOS app to properly validate SSL certificates provided by HTTPS connections. This failure may enable an attacker to conduct man-in-the-middle (MITM) attacks.

Recommendations For versions prior to 8.3.2, update to version 8.3.2 or later to resolve the issue.

Fix

Information Disclosure

Improper Certificate Validation

Weakness Enumeration

CWE-200

CWE-295

Related Identifiers

CVE-2017-3194

Affected Products

Pandora Ios App

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-3194 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3194 · Vendor Advisory
• http://securityfocus.com/bid/97158 · Note
• https://exchange.xforce.ibmcloud.com/collection/XFTAS-Daily-Threat-Assessment-for-March-29-2017-0d704f6eb8163d995bbaf57bbf35a018 · Note
• https://kb.cert.org/vuls/id/342303 · Note
• https://scmagazine.com/pandora-apple-app-vulnerable-to-mitm-attacks/article/647106 · Note