QwikSec

Security Database

CVE

CWE

Training

CVE-2014-2735

Published: Apr 21, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

WinSCP before 5.5.3, when FTP with TLS is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

20140416 CVE-2014-2735 - WinSCP: missing X.509 validation

mailing-list

x_refsource_BUGTRAQ

http://winscp.net/eng/docs/history

x_refsource_CONFIRM

http://winscp.net/tracker/show_bug.cgi?id=1152

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.