CVE-2024-29887CWE-295

Serverpod client accepts any certificate

High · published March 27, 2024

CVSS v3.1
7.4
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the `serverpod_client` package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic and highjack the connection to the server for this vulnerability to be used. Upgrading to version `1.2.6` resolves this issue.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-03-27T18:46Z
EPSS history
Timeline
  • 27 MAR 18:46Z
    Serverpod client accepts any certificate
    cvelistv5