CWE-296: Improper Following of a Certificate's Chain of Trust
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
A kind of CWE-295 Improper Certificate Validation.
From the CWE List. © The MITRE Corporation.
Newest
- temporal technologies, inc. s2s-proxy s2s-proxy accepts untrusted client certificates 9.3 Critical
-
@simplewebauthn/servernpm SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor 2.0 Low - seiko epson corporation multiple seiko epson printers and scanners Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle... 6.3 Medium
- slate digital llc digital connect Slate Digital Connect macOS XPC certificate validation privilege escalation 8.4 High
- erlang otp, erlang\/otp, red hat hardened images +3 more +5 more Non-CA certificate accepted as intermediate issuer in public_key path validation 7.0 High
- arubanetworks arubaos, sd-wan, hewlett packard enterprise (hpe) hpe aruba networking wireless operating system (aos) +2 more Authenticated Remote Code Execution via Arbitrary File Overwrite in the AOS-8 and AOS-10 Web-Based Management Interface 7.2 High
- desktime time tracking app, draugiemgroup desktime time tracking +1 more Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App 4.8 Medium
- juniper junos, juniper networks junos os +1 more Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication 8.3 High
- canonical juju Improper TLS Client/Server authentication and certificate verification on Database Cluster 10.0 Critical
- linuxfoundation strimzi kafka operator, red hat streams for apache kafka 2, streams for apache kafka 3 +1 more +3 more Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication 8.1 High
- linuxfoundation strimzi, strimzi strimzi-kafka-operator +1 more Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clusters 5.9 Medium
-
github.com/opentofu/opentofuGo OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs 5.9 Medium - eclipse jersey Race Condition allows Bypass of Trust Restrictions 9.4 Critical
- icinga, icinga icinga2 +1 more Icinga 2 certificate renewal might incorrectly renew an invalid certificate 9.3 Critical
- ivanti endpoint manager Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before... 4.8 Medium
- ibm openpages with watson IBM OpenPages data manipulation 4.3 Medium
- crowdstrike falcon container sensor, falcon kubernetes admission controller, falcon sensor for linux +2 more CrowdStrike Falcon Sensor for Linux TLS Issue 8.1 High
- nodejs node, node.js, debian linux +7 more +9 more Node.js < 12.22.9, < 14.18.3, < 16.13.2, and < 17.3.1 converts SANs (Subject Alternative Names)... 5.3 Medium
- gallagher command centre mobile connect for android, command centre mobile connect +1 more Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle... 7.7 High
- gallagher command centre mobile client for android, command centre mobile client +1 more Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle... 9.0 Critical
- cisco asyncos, web security appliance (wsa), email security appliance +1 more +3 more Cisco Email Security Appliance and Cisco Web Security Appliance Certificate Validation Vulnerability 7.4 High
- dell data protection central, emc data protection central, emc integrated data protection appliance +2 more Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper... 7.5 High
- gnome evolution-ews, redhat enterprise linux +1 more It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An... 8.1 High