CVE-2024-43201CWE-295

Planet Fitness Workouts mobile apps do not properly validate TLS certificates

High · published September 23, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
33.4
In the wild
Unconfirmed
What it is

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/R:U/V:D/RE:L/U:Amber
EPSS
0.00403 · 33.4th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-09-23T19:11Z
EPSS history
Timeline
  • 23 SEP 19:11Z
    Planet Fitness Workouts mobile apps do not properly validate TLS certificates
    cvelistv5