CVE-2025-43918

Published: Apr 19, 2025Modified: Jun 17, 2026Deferred

6.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Exploitability: 3.1 / Impact: 2.7

Source: MITRE (Secondary)

Description

SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.

Related CWEs

CWE-348

Use of Less Trusted Source

The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

References (2)

https://bugzilla.mozilla.org/show_bug.cgi?id=1961406

Source: cve@mitre.org

https://news.ycombinator.com/item?id=43738485

Source: cve@mitre.org

Timeline

No history available yet.