CVE-2017-3190

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.

CVSS v3 7.5 HIGH
CVSS v2.0 2.9 LOW

7.5^/10

CVSS v3 : HIGH

Vector : AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

2.9^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 5.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/96719	Third Party Advisory VDB Entry
https://www.kb.cert.org/vuls/id/247016	Third Party Advisory US Government Resource
https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/	Third Party Advisory
http://www.securityfocus.com/bid/96719	Third Party Advisory VDB Entry
https://www.kb.cert.org/vuls/id/247016	Third Party Advisory US Government Resource
https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:axs:flash_seats:*:*:*:*:*:iphone_os:*:*

Configuration 2 (hide)

cpe:2.3:a:axs:flash_seats:*:*:*:*:*:android:*:*

History

No history.

Information

Published : 2017-12-16 02:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-3190

Mitre link : CVE-2017-3190

CVE.ORG link : CVE-2017-3190

JSON object : View

Products Affected

axs

flash_seats

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2017-3190", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2017-12-16T02:29:10.230", "references": [{"url": "http://www.securityfocus.com/bid/96719", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/247016", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/", "tags": ["Third Party Advisory"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/96719", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.kb.cert.org/vuls/id/247016", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cret@cert.org", "description": [{"lang": "en", "value": "CWE-295"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks."}, {"lang": "es", "value": "La versi\u00f3n 1.7.9 de Flash Seats Mobile App para Android y las versiones 1.9.51 y anteriores para iOS no consigue validar correctamente los certificados SSL proporcionados por las conexiones HTTPS, lo que puede permitir a un atacante realizar ataques Man-in-the-Middle (MitM)."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axs:flash_seats:*:*:*:*:*:iphone_os:*:*", "vulnerable": true, "matchCriteriaId": "2C8B36E3-988F-4D5F-A01B-9AD129F8527C", "versionEndIncluding": "1.9.51"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:axs:flash_seats:*:*:*:*:*:android:*:*", "vulnerable": true, "matchCriteriaId": "54B084CA-7F1E-4CED-BCF7-3035DD95CD89", "versionEndIncluding": "1.7.9"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}