VulnerabilityModified
CVE-2023-22367
Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle…
MEDIUM 5.9EPSS 0.51%
Does this matter?
Lower severity and a low EPSS score (0.51%). Track it; it rarely justifies an emergency change on its own.
Description
Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
- CVSS 3.1
- 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.51% probability · 42th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- ichiranusa/ichiran
- Source
- vultures@jpcert.or.jp
References
- https://apps.apple.com/jp/app/%E4%B8%80%E8%98%AD%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1118806170Product
- https://jvn.jp/en/jp/JVN11257333/Third Party Advisory
- https://play.google.com/store/apps/details?id=jp.co.ichiran.app&hl=jaProduct
- https://apps.apple.com/jp/app/%E4%B8%80%E8%98%AD%E5%85%AC%E5%BC%8F%E3%82%A2%E3%83%97%E3%83%AA/id1118806170Product
- https://jvn.jp/en/jp/JVN11257333/Third Party Advisory
- https://play.google.com/store/apps/details?id=jp.co.ichiran.app&hl=jaProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.