CVE-2022-1805

HIGH Year: 2022
CVSS v3 Score
8.1
High
Weakness Type
CWE-295
View all →

Vulnerability Description

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client.

Related Vulnerabilities

CVE-2015-2318

HIGH
CVSS:8.1(High)

The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a ...

CWE-2952015

CVE-2015-5263

HIGH
CVSS:8.1(High)

pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.

CWE-2952015

CVE-2015-8960

HIGH
CVSS:8.1(High)

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute th...

CWE-2952015

CVE-2016-10931

HIGH
CVSS:8.1(High)

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostn...

CWE-2952016

CVE-2016-1148

HIGH
CVSS:8.1(High)

Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.

CWE-2952016

CVE-2016-7075

HIGH
CVSS:8.1(High)

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authenticati...

CWE-2952016