CVE-2017-7192

7.5 HIGH

Published: April 06, 2017 Modified: May 13, 2026

Description

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable (it can be set to true but cannot be set to false).

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://seclists.org/bugtraq/2017/Apr/66

Source: cve@mitre.org

https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6

Source: cve@mitre.org

Patch Third Party Advisory

https://github.com/daltoniam/Starscream/releases/tag/2.0.4

Source: cve@mitre.org

Release Notes Third Party Advisory

http://seclists.org/bugtraq/2017/Apr/66

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/daltoniam/Starscream/commit/dbeb1190b8dcbff4f0b797f9e9d9b9b864d1f0d6

Source: af854a3a-2127-422b-91ae-364da2661108

Patch Third Party Advisory

https://github.com/daltoniam/Starscream/releases/tag/2.0.4

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes Third Party Advisory

6 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.5 / 10.0

EPSS (Exploit Probability)

1.9%

77th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-295

Affected Vendors

starscream_project

Related CVEs