Missing SSL Certificate Validation in ThreatTrack VIPRE Password Vault for iOS
CVE-2020-14981

5.9MEDIUM

Key Information:

Vendor

Vipre

Status
Password Vault
Vendor
CVE Published:
22 June 2020

What is CVE-2020-14981?

The VIPRE Password Vault app for iOS has a vulnerability that allows for missing SSL certificate validation. This issue can expose users to potential man-in-the-middle attacks, where an attacker could intercept sensitive data during transmission. Users may unknowingly connect to insecure servers, allowing for unauthorized data access and compromise of sensitive information managed by the app. It is crucial for users to ensure they are using secure connections while transmitting sensitive information in order to safeguard their credentials.

References

https://www.info-sec.ca/advisories/Vipre-Password-Vault.html
x_refsource_MISC
http://packetstormsecurity.com/files/158323/VIPRE-Passwor...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2020-14981 : Missing SSL Certificate Validation in ThreatTrack VIPRE Password Vault for iOS