PT-2024-30367 · Planet Fitness · Planet Fitness Workouts

Braelynn Luedtke + 3 · Published 2024-09-23 · Updated 2025-02-28 · CVE-2024-43201

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/R:U/V:D/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions The Planet Fitness Workouts iOS and Android mobile apps versions prior to 9.8.12

Description The issue is related to the failure of the Planet Fitness Workouts iOS and Android mobile apps to properly validate TLS certificates. This allows an attacker with appropriate network access to obtain session tokens and sensitive information.

Recommendations For versions prior to 9.8.12, update to version 9.8.12 or later to resolve the issue. As a temporary workaround, consider restricting network access to the app until the update is applied.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2024-43201

Affected Products

Planet Fitness Workouts

References · 10

• 🔥 https://dontvacuum.me/bugs/pf · Exploit
• https://osv.dev/vulnerability/CVE-2024-43201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43201 · Security Note
• https://t.me/cvenotify/112849 · Telegram Post
• https://t.me/cvedetector/6212 · Telegram Post
• https://twitter.com/cracbot/status/1839183204676415736 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1838351211789001057 · Twitter Post
• https://twitter.com/cracbot/status/1838820852546326755 · Twitter Post
• https://apps.apple.com/us/app/planet-fitness-workouts/id399857015 · Note
• https://twitter.com/CVEnew/status/1838298755595985039 · Twitter Post