Information disclosure

2019-07-0514:15:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.4%

JSON

The Android App ‘Tootdon for Mastodon’ version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CPENameOperatorVersion
tootdon_for_mastodonle3.4.1

CPE	Name	Operator	Version
	tootdon_for_mastodon	le	3.4.1

References

blog.mastodon-tootdon.com/entry/2019/05/20/204019

jvn.jp/en/jp/JVN57806517/index.html