PT-2018-5693 · Shein · Shein

Published 2018-07-12 · Updated 2019-10-03 · CVE-2017-14710

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SHEIN - Fashion Shopping app for iOS (affected versions not specified)

Description: The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the app does not verify X.509 certificates from SSL servers.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-14710

Affected Products

Shein

References · 2

• 🔥 https://crissyfield.de/blog/2017/12/14/missing-certificate-validation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-14710 · Security Note