CVE-2023-3615: Lack of server certificate validation in websockets connection
Published Jul 17, 2023
·Updated
Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection.
Affected Software
1 affected component
Mattermost Mattermost Iphone Os<2.5.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mattermost iOS appto a version that resolves this vulnerability.Fixed in 2.5.1
Event History
Jul 17, 2023
CVE Published
via MITRE·03:33 PM
Data Sourced
via MITRE·03:33 PM
RemedyDescriptionSeverityWeakness
Data Sourced
04:15 PM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-3615?
The severity of CVE-2023-3615 is high with a severity rating of 8.1.
2
How does Mattermost iOS app fail to validate the server certificate?
The Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection.
3
What is the impact of the vulnerability in Mattermost iOS app?
The vulnerability allows a network attacker to intercept the WebSockets connection.
4
Which versions of Mattermost iOS app are affected by the vulnerability?
The vulnerability affects Mattermost iOS app versions up to and excluding 2.5.1.
5
How can I mitigate the vulnerability in Mattermost iOS app?
To mitigate the vulnerability, update Mattermost iOS app to a version above 2.5.1.