PT-2017-16755 · Emirates Nbd · Emirates Nbd Ksa App

Published 2017-05-05 · Updated 2017-05-17 · CVE-2017-5915

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Emirates NBD KSA app versions 2.0.1 through 2.1.0 Emirates NBD KSA app versions 3.10.0 through 3.10.4

Description The issue concerns the failure to verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Recommendations For versions 2.0.1 through 2.1.0, consider disabling the use of SSL connections until a patch is available. For versions 3.10.0 through 3.10.4, consider disabling the use of SSL connections until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-5915

Affected Products

Emirates Nbd Ksa App

References · 3

• https://osv.dev/vulnerability/CVE-2017-5915 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5915 · Security Note
• https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f · Note