CVE-2018-0611 The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a cra...
HighCVSS 7.4
EPSS 0.50%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ana | <= 4.0.22 | No fix listed |
| ALL NIPPON AIRWAYS CO., LTD ANA App for iOS | = version 4.0.22 and earlier | No fix listed |
References
- JVN#71535108 third-party-advisory
- www.ana.co.jp vendor-advisory