En bref
- CVE-2017-1000209 est une vulnérabilité MOYENNE (CVSS 5.9) touchant com.neovisionaries:nv-websocket-client, nv-websocket-client (nv-websocket-client project).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.66%, plus élevée que 51.8% des vulnérabilités.
- Correctif : mettre à jour vers 2.1 ou plus récent.
Description
The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.
NVD description
The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free