CVE-2017-5915

Published: May 5, 2017Modified: May 13, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected (8)

Products: Emirates Nbd Bank P.j.s.c: Emirates Nbd, Emirates Nbd Ksa

Emirates Nbd Bank P.j.s.c

2 products

Emirates Nbd

Emirates Nbd Ksa

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Emirates Nbd Bank P.j.s.c Emirates Nbd	Version 3.10.0
Emirates Nbd Bank P.j.s.c Emirates Nbd	Version 3.10.1
Emirates Nbd Bank P.j.s.c Emirates Nbd	Version 3.10.2
Emirates Nbd Bank P.j.s.c Emirates Nbd	Version 3.10.3
Emirates Nbd Bank P.j.s.c Emirates Nbd	Version 3.10.4
Emirates Nbd Bank P.j.s.c Emirates Nbd Ksa	Version 2.0.0
Emirates Nbd Bank P.j.s.c Emirates Nbd Ksa	Version 2.0.1
Emirates Nbd Bank P.j.s.c Emirates Nbd Ksa	Version 2.1.0

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f

Source: cve@mitre.org

https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029f

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.