CVE-2025-43918CWE-348

SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued…

Medium · published April 19, 2025

CVSS v3.1
6.4
EPSS
0%
Percentile
1.0
In the wild
Unconfirmed
What it is

SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00104 · 1.0th percentile
Weakness
CWE-348 · Use of Less Trusted Source
Published
2025-04-19T00:00Z
EPSS history
Timeline
  • 19 APR 00:00Z
    SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued…
    cvelistv5