Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname…
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- TPC Software
- Product
- Matchpoint
- CVSS v4.0
- 9.1 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Weakness
- CWE-295
- Exposure class
- Mobile OS
- NVD status
- Deferred
Why it ranks 44 (Notable)
- CVSS v4.0 9.1 critical
- Product class: mobile OS
- Widely deployed vendor product (TPC Software)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.