Skip to content
OpenAdvisories

Weakness (CWE)

CWE-370: Missing Check for Certificate Revocation after Initial Check

Variant Draft

The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time.

How to prevent it (1 mitigation)

  1. Architecture and Design

    Ensure that certificates are checked for revoked status before each use of a protected resource. If the certificate is checked before each access of a protected resource, the delay subject to a possible race condition becomes almost negligible and significantly reduces the risk associated with this issue.

Source: MITRE CWE-370

All Critical High Medium Low Exploited only Public exploit

1 result · Feed