Improper Certificate Validation in PortSwigger Burp Suite
CVE-2018-10377

5.9MEDIUM

Key Information:

Vendor

Portswigger

Status
Burp Suite
Vendor
CVE Published:
17 June 2018

What is CVE-2018-10377?

The Burp Suite by PortSwigger is susceptible to improper validation of the Collaborator server certificate. This vulnerability could allow attackers to perform man-in-the-middle attacks, potentially leading to the compromise of sensitive interaction data. Users of versions prior to 1.7.34 should be aware of this risk and take necessary precautions.

References

http://releases.portswigger.net/2018/06/1734.html
x_refsource_MISC
https://hackerone.com/reports/337680
x_refsource_MISC
https://integritylabs.io/advisories/cve-2018-10377
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.