PT-2017-16754 · Dot It · Dot It Banque Zitouna App

Published 2017-05-05 · Updated 2021-06-01 · CVE-2017-5914

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DOT IT Banque Zitouna app version 2.1 for iOS

Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from SSL servers.

Recommendations For DOT IT Banque Zitouna app version 2.1 for iOS, consider implementing certificate verification to prevent man-in-the-middle attacks. As a temporary workaround, restrict the use of the app on unsecured networks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-5914

Affected Products

Dot It Banque Zitouna App

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-5914 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5914 · Vendor Advisory
• https://t.me/cvenotify/15353 · Telegram Post
• https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f · Note