PT-2018-13950 · Postman · Postman

Ludwig Stage · Published 2018-09-26 · Updated 2024-02-01 · CVE-2018-17215

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Postman versions through 6.3.0

Description An information-disclosure issue was discovered in Postman. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway, with only the response not being displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker, for example, user credentials.

Recommendations For Postman versions through 6.3.0, update to a version later than 6.3.0 to resolve the issue. As a temporary workaround, consider disabling HTTPS requests in Postman until a patch is available. Restrict access to sensitive information when using Postman to minimize the risk of exploitation. Avoid using Postman to send sensitive information over HTTPS until the issue is resolved.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-17215

Affected Products

Postman

References · 5

• 🔥 https://seclists.org/bugtraq/2018/Sep/56 · Exploit
• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17215 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17215 · Vendor Advisory
• https://t.me/cvenotify/69616 · Telegram Post