CVE-2021-34599CWE-295

Improper Certificate Validation in CODESYS Git

High · published December 1, 2021

CVSS v3.1
7.4
EPSS
0%
Percentile
40.0
In the wild
Unconfirmed
What it is

Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2021-12-01T09:00Z
EPSS history
Timeline
  • 01 DEC 09:00Z
    Improper Certificate Validation in CODESYS Git
    cvelistv5