The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
References
Link | Resource |
---|---|
https://medium.com/@chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f | Press/Media Coverage Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Information
Published : 2017-05-05 00:29
Updated : 2017-05-15 18:25
NVD link : CVE-2017-5901
Mitre link : CVE-2017-5901
JSON object : View
CWE
CWE-295
Improper Certificate Validation
Products Affected
state_bank_of_india
- state_bank_anywhere