CVE-2024-37015

An issue was discovered in Ada Web Server 20.0

High · published August 13, 2024

CVSS v3.1
7.4
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

An issue was discovered in Ada Web Server 20.0. When configured to use SSL (which is not the default setting), the SSL/TLS used to establish connections to external services is done without proper hostname validation. This is exploitable by man-in-the-middle attackers.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.8th percentile
Published
2024-08-13T00:00Z
EPSS history
Timeline
  • 13 AUG 00:00Z
    An issue was discovered in Ada Web Server 20.0
    cvelistv5