Missing SSL Certificate Validation in Allegro Tech's BigFlow
CVE-2023-25392

5.9MEDIUM

Key Information:

Vendor

Allegro

Status
Bigflow
Vendor
CVE Published:
10 April 2023

What is CVE-2023-25392?

Allegro Tech's BigFlow, prior to version 1.6, is exposed to a vulnerability that arises from missing SSL certificate validation. This oversight could allow attackers to conduct man-in-the-middle attacks, intercepting sensitive data during transmission. To mitigate such risks, users are encouraged to upgrade to the latest version to ensure secure communications.

References

https://github.com/allegro/bigflow/pull/357
https://lutrasecurity.com/en/articles/cve-2023-25392/

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.