CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1913 vulnerabilities reference this CWE, most recent first.
GHSA-6939-J3MF-8M46
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2025-04-20 03:37The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-3212"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-05T07:29:00Z",
"severity": "MODERATE"
},
"details": "The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-6939-j3mf-8m46",
"modified": "2025-04-20T03:37:14Z",
"published": "2022-05-13T01:25:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-3212"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/556600"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98307"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-697H-9H25-W4FM
Vulnerability from github – Published: 2024-02-03 15:30 – Updated: 2024-05-03 15:30curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (OCSP stapling) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
{
"affected": [],
"aliases": [
"CVE-2024-0853"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-03T14:15:50Z",
"severity": "MODERATE"
},
"details": "curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to\nthe same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.",
"id": "GHSA-697h-9h25-w4fm",
"modified": "2024-05-03T15:30:35Z",
"published": "2024-02-03T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0853"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2298922"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2024-0853.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2024-0853.json"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240307-0004"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240426-0009"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240503-0012"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-69P3-XP37-F692
Vulnerability from github – Published: 2022-03-26 00:00 – Updated: 2022-04-08 21:45A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "kubeclient"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0759"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-30T13:12:44Z",
"nvd_published_at": "2022-03-25T19:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).",
"id": "GHSA-69p3-xp37-f692",
"modified": "2022-04-08T21:45:06Z",
"published": "2022-03-26T00:00:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0759"
},
{
"type": "WEB",
"url": "https://github.com/ManageIQ/kubeclient/issues/554"
},
{
"type": "WEB",
"url": "https://github.com/ManageIQ/kubeclient/issues/555"
},
{
"type": "WEB",
"url": "https://github.com/ManageIQ/kubeclient/pull/556"
},
{
"type": "WEB",
"url": "https://github.com/ManageIQ/kubeclient/commit/109ea71de5a8881748f03ebbe103b49f0f1c7887"
},
{
"type": "PACKAGE",
"url": "https://github.com/ManageIQ/kubeclient"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kubeclient/CVE-2022-0759.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Certificate Validation in kubeclient"
}
GHSA-6C5P-CRMR-MRGH
Vulnerability from github – Published: 2022-05-24 17:21 – Updated: 2023-01-27 18:30The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.
{
"affected": [],
"aliases": [
"CVE-2020-14980"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-22T18:15:00Z",
"severity": "MODERATE"
},
"details": "The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.",
"id": "GHSA-6c5p-crmr-mrgh",
"modified": "2023-01-27T18:30:33Z",
"published": "2022-05-24T17:21:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14980"
},
{
"type": "WEB",
"url": "https://www.info-sec.ca/advisories/Sophos-Secure-Email.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/158322/Sophos-Secure-Email-Android-Application-3.9.4-Man-In-The-Middle.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6C5R-4WFC-3MCX
Vulnerability from github – Published: 2025-08-01 18:31 – Updated: 2025-08-01 21:09Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-6037"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-01T21:09:19Z",
"nvd_published_at": "2025-08-01T18:15:57Z",
"severity": "MODERATE"
},
"details": "Vault and Vault Enterprise (\u201cVault\u201d) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted certificate+|https://developer.hashicorp.com/vault/api-docs/auth/cert#certificate]. In this configuration, an attacker may be able to craft a malicious certificate that could be used to impersonate another user. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23.",
"id": "GHSA-6c5r-4wfc-3mcx",
"modified": "2025-08-01T21:09:19Z",
"published": "2025-08-01T18:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6037"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/vault"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Hashicorp Vault has Incorrect Validation for Non-CA Certificates"
}
GHSA-6CWM-WM82-HGRW
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2024-07-03 21:05Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mongodb/mongo-tools"
},
"ranges": [
{
"events": [
{
"introduced": "100.0.0"
},
{
"fixed": "100.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7924"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-13T20:32:52Z",
"nvd_published_at": "2021-04-12T17:15:00Z",
"severity": "MODERATE"
},
"details": "Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.",
"id": "GHSA-6cwm-wm82-hgrw",
"modified": "2024-07-03T21:05:45Z",
"published": "2022-05-24T17:47:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7924"
},
{
"type": "WEB",
"url": "https://github.com/mongodb/mongo-tools/commit/8c1800b5155084f954a39a1f2f259efac3bb86de"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-6cwm-wm82-hgrw"
},
{
"type": "PACKAGE",
"url": "https://github.com/mongodb/mongo-tools"
},
{
"type": "WEB",
"url": "https://jira.mongodb.org/browse/TOOLS-2587"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "MongoDB Tools Improper Certificate Validation vulnerability"
}
GHSA-6CXJ-8MC8-27H3
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' installations (that have the same software version). This provides remote access to SQL database credentials. (In the normal use of the product, retrieving those credentials only occurs after a username/password authentication step; however, this authentication step is on the client side, and an attacker can develop their own client that skips this step.)
{
"affected": [],
"aliases": [
"CVE-2021-35193"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-30T19:15:00Z",
"severity": "HIGH"
},
"details": "Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers\u0027 installations (that have the same software version). This provides remote access to SQL database credentials. (In the normal use of the product, retrieving those credentials only occurs after a username/password authentication step; however, this authentication step is on the client side, and an attacker can develop their own client that skips this step.)",
"id": "GHSA-6cxj-8mc8-27h3",
"modified": "2022-05-24T19:09:19Z",
"published": "2022-05-24T19:09:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35193"
},
{
"type": "WEB",
"url": "https://github.com/jshafer817/Eaglesoft"
},
{
"type": "WEB",
"url": "https://justinshafer.blogspot.com/2021/07/eaglesoft-18-through-21-vulnerability.html"
},
{
"type": "WEB",
"url": "http://patterson.eaglesoft.net/Home/Contact-Us"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6F5F-6FG8-34Q8
Vulnerability from github – Published: 2022-05-14 02:57 – Updated: 2025-04-20 03:39The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
{
"affected": [],
"aliases": [
"CVE-2017-9601"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-16T12:29:00Z",
"severity": "MODERATE"
},
"details": "The \"FNB Kemp Mobile Banking\" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.",
"id": "GHSA-6f5f-6fg8-34q8",
"modified": "2025-04-20T03:39:14Z",
"published": "2022-05-14T02:57:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9601"
},
{
"type": "WEB",
"url": "https://medium.com/%40chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
},
{
"type": "WEB",
"url": "https://medium.com/@chronic_9612/advisory-44-credit-union-apps-for-ios-may-allow-login-credential-exposure-4d2f380b85c5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6FR3-286Q-Q3CR
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2023-05-23 20:56Jenkins Mailer Plugin prior to 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.
Mailer Plugin 1.32.1, 1.31.1, and 1.29.1 validates the SMTP hostname when connecting via TLS by default. In Mailer Plugin 1.32 and earlier, administrators can set the Java system property mail.smtp.ssl.checkserveridentity to true on startup to enable this protection.
In case of problems, this protection can be disabled again by setting the Java system property mail.smtp.ssl.checkserveridentity to false on startup.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:mailer"
},
"ranges": [
{
"events": [
{
"introduced": "1.32"
},
{
"fixed": "1.32.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.32"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:mailer"
},
"ranges": [
{
"events": [
{
"introduced": "1.30"
},
{
"fixed": "1.31.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:mailer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.29.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2252"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-23T23:19:44Z",
"nvd_published_at": "2020-09-16T14:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Mailer Plugin prior to 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.\n\nMailer Plugin 1.32.1, 1.31.1, and 1.29.1 validates the SMTP hostname when connecting via TLS by default. In Mailer Plugin 1.32 and earlier, administrators can set the Java system property mail.smtp.ssl.checkserveridentity to true on startup to enable this protection.\n\nIn case of problems, this protection can be disabled again by setting the Java system property mail.smtp.ssl.checkserveridentity to false on startup.",
"id": "GHSA-6fr3-286q-q3cr",
"modified": "2023-05-23T20:56:20Z",
"published": "2022-05-24T17:28:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2252"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/mailer-plugin/commit/e1893c6d105669f134ee5c5212ef9f3944d7d00d"
},
{
"type": "WEB",
"url": "https://github.com/CVEProject/cvelist/blob/16860a328d970faa6e4350b0fa446f64a52e52ca/2020/2xxx/CVE-2020-2252.json"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-1813"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/09/16/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin"
}
GHSA-6FW4-X9R3-MVGH
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation.
{
"affected": [],
"aliases": [
"CVE-2021-32581"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-05T20:15:00Z",
"severity": "HIGH"
},
"details": "Acronis True Image prior to 2021 Update 4 for Windows, Acronis True Image prior to 2021 Update 5 for Mac, Acronis Agent prior to build 26653, Acronis Cyber Protect prior to build 27009 did not implement SSL certificate validation.",
"id": "GHSA-6fw4-x9r3-mvgh",
"modified": "2022-05-24T19:10:10Z",
"published": "2022-05-24T19:10:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32581"
},
{
"type": "WEB",
"url": "https://kb.acronis.com/content/68413"
},
{
"type": "WEB",
"url": "https://kb.acronis.com/content/68419"
},
{
"type": "WEB",
"url": "https://kb.acronis.com/content/68648"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.