PT-2018-7241 · Threatmetrix · Threatmetrix Sdk

Will Dormann · Published 2018-07-24 · Updated 2019-10-09 · CVE-2017-3182

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ThreatMetrix SDK versions prior to 3.2

Description: The issue concerns the failure to validate SSL certificates provided by HTTPS connections, potentially allowing an attacker to perform a man-in-the-middle (MITM) attack. ThreatMetrix is a security library for mobile applications aimed at providing fraud prevention and device identity capabilities. An affected application communicates with "https://h-sdk.online-metrix.net" regardless of the connection's security. This could enable an attacker on the same network or upstream from the iOS device to view or modify ThreatMetrix network traffic that should have been protected by HTTPS.

Recommendations: For ThreatMetrix SDK versions prior to 3.2, update to version 3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the https://h-sdk.online-metrix.net endpoint until the update is applied.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2017-3182

Affected Products

Threatmetrix Sdk

References · 4

• https://osv.dev/vulnerability/CVE-2017-3182 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3182 · Security Note
• https://securityfocus.com/bid/95360 · Note
• https://kb.cert.org/vuls/id/767208 · Note