Weakness (CWE)

CWE-295: Improper Certificate Validation

Base Draft

The product does not validate, or incorrectly validates, a certificate.

How to prevent it (2 mitigations)

Architecture and Design, Implementation

Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

Source: MITRE CWE-295

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Low 3.7

CVE-2020-9488 Public exploit

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.…

Apache Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Apr 27, 2020
Low 3.7

CVE-2015-4000 Public exploit EPSS 100%

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not pr…

thunderbird firefox openssl openjdk-7 Debian Ubuntu

May 21, 2015