CVE-2020-25680CWE-295

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'

published January 7, 2021

CVSS
—
EPSS
0%
Percentile
25.1
In the wild
Unconfirmed
What it is

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from this vulnerability is to data integrity.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00331 · 25.1th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2021-01-07T17:32Z
EPSS history
Timeline
  • 07 JAN 17:32Z
    A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'
    cvelistv5