CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2267 vulnerabilities reference this CWE, most recent first.
GHSA-3783-6PMV-W66F
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2025-04-20 03:37The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-5905"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-05T07:29:00Z",
"severity": "MODERATE"
},
"details": "The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-3783-6pmv-w66f",
"modified": "2025-04-20T03:37:14Z",
"published": "2022-05-13T01:25:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5905"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-379P-37XC-Q963
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2025-10-22 20:54An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-11076"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-614"
],
"github_reviewed": true,
"github_reviewed_at": "2025-10-22T20:54:31Z",
"nvd_published_at": "2020-06-19T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.",
"id": "GHSA-379p-37xc-q963",
"modified": "2025-10-22T20:54:31Z",
"published": "2022-05-24T17:21:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-11076"
},
{
"type": "WEB",
"url": "https://github.com/mattermost/mattermost/commit/bac25154d659883c801b3bb9a0687f46570f5bbf"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Server does not check if cookies are used over SSL"
}
GHSA-37GX-JQX9-FWMG
Vulnerability from github – Published: 2024-02-20 12:31 – Updated: 2025-02-13 19:12Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
This issue affects Apache DolphinScheduler: before 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.dolphinscheduler:dolphinscheduler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-49250"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:19:01Z",
"nvd_published_at": "2024-02-20T10:15:08Z",
"severity": "HIGH"
},
"details": "Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.\n\nThis issue affects Apache DolphinScheduler: before 3.2.1.\n\nUsers are recommended to upgrade to version 3.2.1, which fixes the issue.",
"id": "GHSA-37gx-jqx9-fwmg",
"modified": "2025-02-13T19:12:56Z",
"published": "2024-02-20T12:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49250"
},
{
"type": "WEB",
"url": "https://github.com/apache/dolphinscheduler/pull/15288"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/dolphinscheduler"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/02/20/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Improper Certificate Validation in Apache DolphinScheduler"
}
GHSA-37PJ-6FCR-2JJQ
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2025-04-20 03:40iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2017-7726"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-11T17:29:00Z",
"severity": "HIGH"
},
"details": "iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.",
"id": "GHSA-37pj-6fcr-2jjq",
"modified": "2025-04-20T03:40:31Z",
"published": "2022-05-13T01:07:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7726"
},
{
"type": "WEB",
"url": "http://dojo.bullguard.com/blog/burglar-hacker-when-a-physical-security-is-compromised-by-iot-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-37PQ-FMVF-2FWX
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-10 21:31MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled it.
As a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority. An attacker capable of intercepting or manipulating network traffic between a MISP instance and a remote HTTPS service could impersonate the remote endpoint and perform a man-in-the-middle attack.
Successful exploitation could allow an attacker to observe sensitive information transmitted by MISP, including authentication material or exchanged threat intelligence, and to modify responses returned to the MISP instance. The impact depends on the functionality using CurlClient and the data exchanged with the remote service.
The patch enables TLS peer verification by default while preserving explicit support for configured self-signed certificates. It also corrects the self-signed certificate handling in SyncTool so that peer verification is disabled only when no pinned CA certificate is configured.
{
"affected": [],
"aliases": [
"CVE-2026-85221"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T15:17:41Z",
"severity": "HIGH"
},
"details": "MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly initialized and therefore defaulted to null. When passed to cURL, this value effectively disabled TLS peer verification unless the calling code explicitly enabled it.\n\n\nAs a result, HTTPS connections made through affected CurlClient instances could accept certificates that were not issued by a trusted certificate authority. An attacker capable of intercepting or manipulating network traffic between a MISP instance and a remote HTTPS service could impersonate the remote endpoint and perform a man-in-the-middle attack.\n\n\nSuccessful exploitation could allow an attacker to observe sensitive information transmitted by MISP, including authentication material or exchanged threat intelligence, and to modify responses returned to the MISP instance. The impact depends on the functionality using CurlClient and the data exchanged with the remote service.\n\n\nThe patch enables TLS peer verification by default while preserving explicit support for configured self-signed certificates. It also corrects the self-signed certificate handling in SyncTool so that peer verification is disabled only when no pinned CA certificate is configured.",
"id": "GHSA-37pq-fmvf-2fwx",
"modified": "2026-09-10T21:31:19Z",
"published": "2026-09-03T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85221"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/e06f69858"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-37RJ-769R-RWRV
Vulnerability from github – Published: 2024-02-15 15:30 – Updated: 2024-02-15 15:30An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6 and 7.4.0 - 7.4.1 allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.
{
"affected": [],
"aliases": [
"CVE-2023-47537"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-15T14:15:45Z",
"severity": "MODERATE"
},
"details": "An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6 and 7.4.0 - 7.4.1 allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch.",
"id": "GHSA-37rj-769r-rwrv",
"modified": "2024-02-15T15:30:29Z",
"published": "2024-02-15T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47537"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-23-301"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-37V2-9GRX-PWQ4
Vulnerability from github – Published: 2026-08-21 00:31 – Updated: 2026-08-21 00:31IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.
{
"affected": [],
"aliases": [
"CVE-2026-17024"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-20T22:17:11Z",
"severity": "HIGH"
},
"details": "IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.",
"id": "GHSA-37v2-9grx-pwq4",
"modified": "2026-08-21T00:31:19Z",
"published": "2026-08-21T00:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17024"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7283858"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3832-9276-X7GF
Vulnerability from github – Published: 2022-05-13 01:10 – Updated: 2024-11-05 22:28Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Note that the Commons HttpClient project is end of life. It has been replaced by the Apache HttpComponents project in its HttpClient and HttpCore modules. CVE-2012-5783 has been patched in v4.0 of the Apache HttpComponents HttpClient module.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 4.0"
},
"package": {
"ecosystem": "Maven",
"name": "commons-httpclient:commons-httpclient"
},
"ranges": [
{
"events": [
{
"introduced": "3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-5783"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-13T13:58:59Z",
"nvd_published_at": "2012-11-04T22:55:00Z",
"severity": "MODERATE"
},
"details": "Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject\u0027s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.\n\nNote that the Commons HttpClient project is [end of life](https://hc.apache.org/httpclient-legacy/). It has been replaced by the Apache HttpComponents project in its [HttpClient](https://hc.apache.org/httpcomponents-client-5.4.x/) and [HttpCore](https://hc.apache.org/httpcomponents-core-5.3.x/) modules. CVE-2012-5783 has been patched in [v4.0](https://repo1.maven.org/maven2/org/apache/httpcomponents/httpclient/4.0/) of the Apache HttpComponents HttpClient module.",
"id": "GHSA-3832-9276-x7gf",
"modified": "2024-11-05T22:28:04Z",
"published": "2022-05-13T01:10:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5783"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:0868"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79984"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/httpcomponents-client"
},
{
"type": "WEB",
"url": "https://issues.apache.org/jira/browse/HTTPCLIENT-1265"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0270.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0679.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0680.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0682.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1853.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0224.html"
},
{
"type": "WEB",
"url": "http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2769-1"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper Certificate Validation in Apache Commons HttpClient"
}
GHSA-38CG-GG9J-Q9J9
Vulnerability from github – Published: 2019-06-27 17:25 – Updated: 2021-08-17 15:33A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-3875"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-345"
],
"github_reviewed": true,
"github_reviewed_at": "2019-06-27T15:43:10Z",
"nvd_published_at": "2019-06-12T14:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols (\u0027http\u0027 or \u0027ldap\u0027) and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn\u0027t validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.",
"id": "GHSA-38cg-gg9j-q9j9",
"modified": "2021-08-17T15:33:33Z",
"published": "2019-06-27T17:25:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3875"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3875"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak"
}
GHSA-38JC-2RWX-QGXR
Vulnerability from github – Published: 2023-04-12 18:30 – Updated: 2023-04-12 22:19Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries.
Job configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:image-tag-parameter"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-30516"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2023-04-12T22:19:45Z",
"nvd_published_at": "2023-04-12T18:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docker registries.\n\nJob configurations using Image Tag Parameters that were created before 2.0 will have SSL/TLS certificate validation disabled by default.",
"id": "GHSA-38jc-2rwx-qgxr",
"modified": "2023-04-12T22:19:45Z",
"published": "2023-04-12T18:30:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30516"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2840"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/04/13/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation"
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.