CVE-2014-2845: Medium severity cyberduck vulnerability
Published Nov 15, 2017
·Updated
Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority.
Affected Software
2 affected components
Cyberduck Cyberduck<4.4.4
Microsoft Windows
Event History
Nov 15, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-2845?
CVE-2014-2845 is classified as a high-severity vulnerability due to its potential for man-in-the-middle attacks.
2
How do I fix CVE-2014-2845?
To fix CVE-2014-2845, upgrade Cyberduck to version 4.4.4 or later.
3
What software is affected by CVE-2014-2845?
CVE-2014-2845 affects Cyberduck versions prior to 4.4.4 on Windows.
4
What type of attack does CVE-2014-2845 allow?
CVE-2014-2845 allows man-in-the-middle attackers to spoof FTP-SSL servers.
5
What is the impact of CVE-2014-2845 on data security?
The impact of CVE-2014-2845 includes the risk of unauthorized access to sensitive data transmitted via FTP-SSL.