Description
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one | — |