CVE-2018-17215

HIGH Year: 2018
CVSS v3 Score
8.1
High
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-295
View all →

Vulnerability Description

An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials).

Related Vulnerabilities

CVE-2015-2318

HIGH
CVSS:8.1(High)

The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a ...

CWE-2952015

CVE-2015-5263

HIGH
CVSS:8.1(High)

pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.

CWE-2952015

CVE-2015-8960

HIGH
CVSS:8.1(High)

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute th...

CWE-2952015

CVE-2016-10931

HIGH
CVSS:8.1(High)

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostn...

CWE-2952016

CVE-2016-1148

HIGH
CVSS:8.1(High)

Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.

CWE-2952016

CVE-2016-7075

HIGH
CVSS:8.1(High)

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authenticati...

CWE-2952016