CVE-2015-3996

MEDIO 4.3CVE-2015-3996 · Published 27/10/2015 · updated 17/06/2026

In breve

CVE-2015-3996 è una vulnerabilità MEDIO (CVSS 4.3) che riguarda afnetworking (afnetworking project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.84%, superiore al 57.9% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
afnetworking afnetworking_project	`≤ 2.5.2`	No fix yet

Description

The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References

securityfocus.com/bid/76242
AFNetworking/AFNetworking
AFNetworking/AFNetworking release 2.5.3
owncloud.org/security/advisory · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free