CWE-299Improper Check for Certificate Revocation

Description

The product does not check or incorrectly checks the revocation status of a certificate.

Common consequences

• Access Control→Gain Privileges or Assume Identity
  Trust may be assigned to an untrusted entity who somehow obtained the certificate, i.e., the entity is not who it claims to be.
• Integrity,Other→Other
  Data from an untrusted (and possibly malicious) source may be integrated.
• Confidentiality→Read Application Data
  Data may be disclosed to an untrusted entity that obtained access to the certificate, thereby impersonating a trusted entity, resulting in information disclosure.

Potential mitigations

• Architecture and Design
  Ensure that certificates are checked for revoked status.
• Implementation
  If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.

Related CWEs

Recent CVEs classified under this CWE