CWE-295Improper Certificate Validation

Description

The product does not validate, or incorrectly validates, a certificate.

Common consequences

• Integrity,Authentication→Bypass Protection Mechanism,Gain Privileges or Assume Identity
  When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a tru

Potential mitigations

• Architecture and Design,Implementation
  Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
• Implementation
  If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

Related CWEs

Recent CVEs classified under this CWE