CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2156 vulnerabilities reference this CWE, most recent first.
GHSA-7CP4-W7Q7-W394
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificate's validity in the code that checks for a test success or failure. It ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).
{
"affected": [],
"aliases": [
"CVE-2017-2629"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-27T19:29:00Z",
"severity": "MODERATE"
},
"details": "curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server\u0027s certificate\u0027s validity in the code that checks for a test success or failure. It ends up always thinking there\u0027s valid proof, even when there is none or if the server doesn\u0027t support the TLS extension in question. This could lead to users not detecting when a server\u0027s certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. This flaw also exists in the command line tool (--cert-status).",
"id": "GHSA-7cp4-w7q7-w394",
"modified": "2022-05-13T01:36:53Z",
"published": "2022-05-13T01:36:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2629"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2629"
},
{
"type": "WEB",
"url": "https://curl.haxx.se/docs/adv_20170222.html"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201703-04"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/tns-2017-09"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96382"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037871"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7F2C-FJ5R-9F75
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.
{
"affected": [],
"aliases": [
"CVE-2020-8279"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-19T01:15:00Z",
"severity": "HIGH"
},
"details": "Missing validation of server certificates for out-going connections in Nextcloud Social \u003c 0.4.0 allowed a man-in-the-middle attack.",
"id": "GHSA-7f2c-fj5r-9f75",
"modified": "2022-05-24T17:34:46Z",
"published": "2022-05-24T17:34:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8279"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/915585"
},
{
"type": "WEB",
"url": "https://nextcloud.com/security/advisory/?id=NC-SA-2020-043"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7F2C-VP52-GMFW
Vulnerability from github – Published: 2022-05-17 03:45 – Updated: 2024-09-27 18:23OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "keystonemiddleware"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "keystonemiddleware"
},
"ranges": [
{
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.2.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "python-keystoneclient"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "python-keystoneclient"
},
"ranges": [
{
"events": [
{
"introduced": "1.0"
},
{
"fixed": "1.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-7144"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-16T23:05:33Z",
"nvd_published_at": "2014-10-02T14:55:00Z",
"severity": "HIGH"
},
"details": "OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the \"insecure\" option is set in a paste configuration (`paste.ini`) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.",
"id": "GHSA-7f2c-vp52-gmfw",
"modified": "2024-09-27T18:23:46Z",
"published": "2022-05-17T03:45:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7144"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/python-keystoneclient/+bug/1353315"
},
{
"type": "WEB",
"url": "https://github.com/openstack/ossa/blob/23e15de721f4a6890374a231d93524e02965a97f/ossa/OSSA-2014-030.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2014-26.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2014-71.yaml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228053850/http://www.securityfocus.com/bid/69864"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228060511/https://www.securityfocus.com/bid/69864"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1783.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1784.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0020.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/09/25/51"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2705-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenStack keystonemiddleware does not verify certificate"
}
GHSA-7F3M-MQM5-5X2C
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-07-14 21:31If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This vulnerability affects Firefox < 140.
{
"affected": [],
"aliases": [
"CVE-2025-6433"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-24T13:15:24Z",
"severity": "CRITICAL"
},
"details": "If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires \"a secure transport established without errors\". This vulnerability affects Firefox \u003c 140.",
"id": "GHSA-7f3m-mqm5-5x2c",
"modified": "2025-07-14T21:31:44Z",
"published": "2025-06-26T21:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6433"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1954033"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-51"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2025-54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7F55-FQW6-8JJP
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in bztransmit helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.
{
"affected": [],
"aliases": [
"CVE-2020-8289"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-27T02:15:00Z",
"severity": "HIGH"
},
"details": "Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.",
"id": "GHSA-7f55-fqw6-8jjp",
"modified": "2022-05-24T17:37:30Z",
"published": "2022-05-24T17:37:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8289"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/818853"
},
{
"type": "WEB",
"url": "https://github.com/geffner/CVE-2020-8289/blob/master/README.md"
},
{
"type": "WEB",
"url": "https://www.backblaze.com/blog/backblaze-cloud-backup-release-7-0-1"
},
{
"type": "WEB",
"url": "https://youtu.be/W0THXbcX5V8"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/57"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/58"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7FF6-526R-2F67
Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2022-05-14 01:08rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.
{
"affected": [],
"aliases": [
"CVE-2015-1777"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-12T15:29:00Z",
"severity": "MODERATE"
},
"details": "rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.",
"id": "GHSA-7ff6-526r-2f67",
"modified": "2022-05-14T01:08:49Z",
"published": "2022-05-14T01:08:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1777"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1198740"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/03/04/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/72943"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7FH7-MV59-556W
Vulnerability from github – Published: 2022-05-14 03:37 – Updated: 2022-05-14 03:37Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present.
{
"affected": [],
"aliases": [
"CVE-2017-17455"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-20T22:29:00Z",
"severity": "MODERATE"
},
"details": "Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present.",
"id": "GHSA-7fh7-mv59-556w",
"modified": "2022-05-14T03:37:35Z",
"published": "2022-05-14T03:37:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17455"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/mahara/+bug/1734767"
},
{
"type": "WEB",
"url": "https://mahara.org/interaction/forum/topic.php?id=8150"
},
{
"type": "WEB",
"url": "https://reviews.mahara.org/#/c/8312"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7FHQ-P887-492P
Vulnerability from github – Published: 2022-05-14 01:57 – Updated: 2022-05-14 01:57An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials).
{
"affected": [],
"aliases": [
"CVE-2018-17215"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-09-26T21:29:00Z",
"severity": "HIGH"
},
"details": "An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server\u0027s X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials).",
"id": "GHSA-7fhq-p887-492p",
"modified": "2022-05-14T01:57:32Z",
"published": "2022-05-14T01:57:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-17215"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2018/Sep/56"
},
{
"type": "WEB",
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7FMQ-3CJW-PVHF
Vulnerability from github – Published: 2025-04-08 15:31 – Updated: 2025-04-08 15:31Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers.
{
"affected": [],
"aliases": [
"CVE-2025-22459"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-296"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-08T15:15:49Z",
"severity": "MODERATE"
},
"details": "Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers.",
"id": "GHSA-7fmq-3cjw-pvhf",
"modified": "2025-04-08T15:31:06Z",
"published": "2025-04-08T15:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22459"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7GF7-7WX4-MXMW
Vulnerability from github – Published: 2022-04-21 01:57 – Updated: 2024-05-02 13:14Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "mercurial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2010-4237"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-02T13:14:02Z",
"nvd_published_at": "2019-10-29T19:15:00Z",
"severity": "MODERATE"
},
"details": "Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.",
"id": "GHSA-7gf7-7wx4-mxmw",
"modified": "2024-05-02T13:14:02Z",
"published": "2022-04-21T01:57:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4237"
},
{
"type": "WEB",
"url": "https://github.com/dscho/hg/commit/4ea63fb25ceeeaaa4cd1026f733b7ea7672c30b3"
},
{
"type": "WEB",
"url": "https://github.com/dscho/hg/commit/89baabf4fb7abf30ef6fdcf3d455a7893e5cc145"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237"
},
{
"type": "WEB",
"url": "https://bz.mercurial-scm.org/show_bug.cgi?id=2407"
},
{
"type": "WEB",
"url": "https://repo.mercurial-scm.org/hg/rev/6ab4a7d3c179"
},
{
"type": "WEB",
"url": "https://repo.mercurial-scm.org/hg/rev/f2937d6492c5"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-4237"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mercurial Improper Certificate Validation vulnerability"
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.