Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2022-21170

Summary
Assigner-jpcert
Assigner Org ID-ede6fdc4-6654-4307-a26d-3331c018e2ce
Published At-07 Mar, 2022 | 09:00
Updated At-03 Aug, 2024 | 02:31
Rejected At-
Credits

Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a man-in-the-middle attack and eavesdrop on an encrypted communication.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:jpcert
Assigner Org ID:ede6fdc4-6654-4307-a26d-3331c018e2ce
Published At:07 Mar, 2022 | 09:00
Updated At:03 Aug, 2024 | 02:31
Rejected At:
▼CVE Numbering Authority (CNA)

Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a man-in-the-middle attack and eavesdrop on an encrypted communication.

Affected Products
Vendor
Digital Arts Inc.
Product
i-FILTER, i-FILTER Browser & Cloud MultiAgent for Windows, and D-SPA using i-FILTER
Versions
Affected
  • i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER
Problem Types
TypeCWE IDDescription
textN/AImproper check for certificate revocation
Type: text
CWE ID: N/A
Description: Improper check for certificate revocation
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://download.daj.co.jp/user/ifilter/V10/
x_refsource_MISC
https://download.daj.co.jp/user/ifilter/V9/
x_refsource_MISC
https://download.daj.co.jp/user/ifb/
x_refsource_MISC
https://download.daj.co.jp/user/dspa/V4/
x_refsource_MISC
https://download.daj.co.jp/user/dspa/V3/
x_refsource_MISC
https://jvn.jp/en/jp/JVN33214411/index.html
x_refsource_MISC
Hyperlink: https://download.daj.co.jp/user/ifilter/V10/
Resource:
x_refsource_MISC
Hyperlink: https://download.daj.co.jp/user/ifilter/V9/
Resource:
x_refsource_MISC
Hyperlink: https://download.daj.co.jp/user/ifb/
Resource:
x_refsource_MISC
Hyperlink: https://download.daj.co.jp/user/dspa/V4/
Resource:
x_refsource_MISC
Hyperlink: https://download.daj.co.jp/user/dspa/V3/
Resource:
x_refsource_MISC
Hyperlink: https://jvn.jp/en/jp/JVN33214411/index.html
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://download.daj.co.jp/user/ifilter/V10/
x_refsource_MISC
x_transferred
https://download.daj.co.jp/user/ifilter/V9/
x_refsource_MISC
x_transferred
https://download.daj.co.jp/user/ifb/
x_refsource_MISC
x_transferred
https://download.daj.co.jp/user/dspa/V4/
x_refsource_MISC
x_transferred
https://download.daj.co.jp/user/dspa/V3/
x_refsource_MISC
x_transferred
https://jvn.jp/en/jp/JVN33214411/index.html
x_refsource_MISC
x_transferred
Hyperlink: https://download.daj.co.jp/user/ifilter/V10/
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://download.daj.co.jp/user/ifilter/V9/
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://download.daj.co.jp/user/ifb/
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://download.daj.co.jp/user/dspa/V4/
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://download.daj.co.jp/user/dspa/V3/
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://jvn.jp/en/jp/JVN33214411/index.html
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:vultures@jpcert.or.jp
Published At:10 Mar, 2022 | 17:45
Updated At:16 Mar, 2022 | 17:04

Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a man-in-the-middle attack and eavesdrop on an encrypted communication.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.13.7LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary2.04.3MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
Type: Primary
Version: 3.1
Base score: 3.7
Base severity: LOW
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Type: Primary
Version: 2.0
Base score: 4.3
Base severity: MEDIUM
Vector:
AV:N/AC:M/Au:N/C:P/I:N/A:N
CPE Matches

daj
daj
>>i-filter_browser_\&_cloud_multiagent>>Versions up to 4.93r04(inclusive)
cpe:2.3:a:daj:i-filter_browser_\&_cloud_multiagent:*:*:*:*:*:windows:*:*
daj
daj
>>dspa-15000_m5>>3
cpe:2.3:h:daj:dspa-15000_m5:3:*:*:*:*:*:*:*
daj
daj
>>dspa-15000_m5>>4
cpe:2.3:h:daj:dspa-15000_m5:4:*:*:*:*:*:*:*
daj
daj
>>dspa-2000_m4>>4
cpe:2.3:h:daj:dspa-2000_m4:4:*:*:*:*:*:*:*
daj
daj
>>dspa-4000_m4>>4
cpe:2.3:h:daj:dspa-4000_m4:4:*:*:*:*:*:*:*
daj
daj
>>dspa-7000_m5>>3
cpe:2.3:h:daj:dspa-7000_m5:3:*:*:*:*:*:*:*
daj
daj
>>dspa-7000_m5>>4
cpe:2.3:h:daj:dspa-7000_m5:4:*:*:*:*:*:*:*
daj
daj
>>i-filter>>Versions up to 9.50r10(inclusive)
cpe:2.3:a:daj:i-filter:*:*:*:*:*:*:*:*
daj
daj
>>i-filter>>Versions from 10.0(inclusive) to 10.45r01(inclusive)
cpe:2.3:a:daj:i-filter:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-295Primarynvd@nist.gov
CWE ID: CWE-295
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://download.daj.co.jp/user/dspa/V3/vultures@jpcert.or.jp
Permissions Required
Vendor Advisory
https://download.daj.co.jp/user/dspa/V4/vultures@jpcert.or.jp
Permissions Required
Vendor Advisory
https://download.daj.co.jp/user/ifb/vultures@jpcert.or.jp
Permissions Required
Vendor Advisory
https://download.daj.co.jp/user/ifilter/V10/vultures@jpcert.or.jp
Permissions Required
Vendor Advisory
https://download.daj.co.jp/user/ifilter/V9/vultures@jpcert.or.jp
Permissions Required
Vendor Advisory
https://jvn.jp/en/jp/JVN33214411/index.htmlvultures@jpcert.or.jp
Third Party Advisory
VDB Entry
Hyperlink: https://download.daj.co.jp/user/dspa/V3/
Source: vultures@jpcert.or.jp
Resource:
Permissions Required
Vendor Advisory
Hyperlink: https://download.daj.co.jp/user/dspa/V4/
Source: vultures@jpcert.or.jp
Resource:
Permissions Required
Vendor Advisory
Hyperlink: https://download.daj.co.jp/user/ifb/
Source: vultures@jpcert.or.jp
Resource:
Permissions Required
Vendor Advisory
Hyperlink: https://download.daj.co.jp/user/ifilter/V10/
Source: vultures@jpcert.or.jp
Resource:
Permissions Required
Vendor Advisory
Hyperlink: https://download.daj.co.jp/user/ifilter/V9/
Source: vultures@jpcert.or.jp
Resource:
Permissions Required
Vendor Advisory
Hyperlink: https://jvn.jp/en/jp/JVN33214411/index.html
Source: vultures@jpcert.or.jp
Resource:
Third Party Advisory
VDB Entry

Change History

0
Information is not available yet

Similar CVEs

211Records found

CVE-2015-0904
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-5.9||MEDIUM
EPSS-0.33% / 55.46%
||
7 Day CHG~0.00%
Published-25 Jul, 2017 | 18:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack.

Action-Not Available
Vendor-shidaxn/a
Product-restaurant_karaoken/a
CWE ID-CWE-295
Improper Certificate Validation
CVE-2024-4063
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-3.7||LOW
EPSS-0.06% / 17.00%
||
7 Day CHG~0.00%
Published-23 Apr, 2024 | 18:31
Updated-01 Aug, 2024 | 20:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
EZVIZ CS-C6-21WFR-8 Davinci Application certificate validation

A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build 170628. It has been classified as problematic. This affects an unknown part of the component Davinci Application. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The identifier VDB-261789 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Action-Not Available
Vendor-EZVIZezviz
Product-CS-C6-21WFR-8cs-c6-21wfr-8
CWE ID-CWE-295
Improper Certificate Validation
CVE-2021-23155
Matching Score-4
Assigner-Gallagher Group Ltd.
ShareView Details
Matching Score-4
Assigner-Gallagher Group Ltd.
CVSS Score-9||CRITICAL
EPSS-0.13% / 33.12%
||
7 Day CHG~0.00%
Published-18 Nov, 2021 | 17:58
Updated-17 Sep, 2024 | 00:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions.

Action-Not Available
Vendor-Gallagher Group Ltd.
Product-command_centre_mobile_clientCommand Centre Mobile Client for Android
CWE ID-CWE-296
Improper Following of a Certificate's Chain of Trust
CWE ID-CWE-295
Improper Certificate Validation
CVE-2020-14980
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.08% / 24.63%
||
7 Day CHG~0.00%
Published-22 Jun, 2020 | 17:39
Updated-04 Aug, 2024 | 13:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The Sophos Secure Email application through 3.9.4 for Android has Missing SSL Certificate Validation.

Action-Not Available
Vendor-n/aSophos Ltd.
Product-sophos_secure_emailn/a
CWE ID-CWE-295
Improper Certificate Validation
CVE-2021-20989
Matching Score-4
Assigner-CERT@VDE
ShareView Details
Matching Score-4
Assigner-CERT@VDE
CVSS Score-5.9||MEDIUM
EPSS-0.83% / 73.59%
||
7 Day CHG~0.00%
Published-19 Apr, 2021 | 14:05
Updated-17 Sep, 2024 | 00:42
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Fibaro Home Center Insufficient remote access server authorization

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.

Action-Not Available
Vendor-fibaroFibar Group S.A
Product-home_center_2_firmwarehome_center_2home_center_lite_firmwarehome_center_liteFibaro Home Center
CWE ID-CWE-295
Improper Certificate Validation
CVE-2024-4062
Matching Score-4
Assigner-VulDB
ShareView Details
Matching Score-4
Assigner-VulDB
CVSS Score-3.7||LOW
EPSS-0.06% / 17.00%
||
7 Day CHG~0.00%
Published-23 Apr, 2024 | 18:31
Updated-01 Aug, 2024 | 20:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Hualai Xiaofang iSC5 certificate validation

A vulnerability was found in Hualai Xiaofang iSC5 3.2.2_112 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improper certificate validation. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of this vulnerability is VDB-261788. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Action-Not Available
Vendor-Hualai Xiaofanghualai
Product-iSC5isc5
CWE ID-CWE-295
Improper Certificate Validation
CVE-2021-20732
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-5.9||MEDIUM
EPSS-0.13% / 32.66%
||
7 Day CHG~0.00%
Published-09 Jun, 2021 | 01:05
Updated-03 Aug, 2024 | 17:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The ATOM (ATOM - Smart life App for Android versions prior to 1.8.1 and ATOM - Smart life App for iOS versions prior to 1.8.2) does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdrop on encrypted communication via a crafted certificate.

Action-Not Available
Vendor-ATOM (ATOM tech Inc.)
Product-smart_lifeATOM
CWE ID-CWE-295
Improper Certificate Validation
CVE-2020-9488
Matching Score-4
Assigner-Apache Software Foundation
ShareView Details
Matching Score-4
Assigner-Apache Software Foundation
CVSS Score-3.7||LOW
EPSS-0.02% / 4.15%
||
7 Day CHG~0.00%
Published-27 Apr, 2020 | 15:36
Updated-04 Aug, 2024 | 10:26
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Action-Not Available
Vendor-qosThe Apache Software FoundationDebian GNU/LinuxOracle Corporation
Product-retail_bulk_data_integrationpeoplesoft_enterprise_peopletoolsprimavera_unifierreload4jretail_assortment_planningstoragetek_acslspolicy_automationfinancial_services_retail_customer_analyticsfinancial_services_price_creation_and_discoverycommunications_eagle_ftp_table_base_retrievalcommunications_application_session_controllerinsurance_policy_administration_j2eepolicy_automation_for_mobile_devicesspatial_and_graphfinancial_services_analytical_applications_infrastructurecommunications_unified_inventory_managementretail_advanced_inventory_planningcommunications_services_gatekeeperretail_order_broker_cloud_serviceinsurance_insbridge_rating_and_underwritingretail_customer_management_and_segmentation_foundationretail_predictive_application_serverjd_edwards_world_securityinsurance_rules_palettecommunications_billing_and_revenue_managementcommunications_offline_mediation_controllerenterprise_manager_for_peoplesoftsiebel_apps_-_marketingsiebel_ui_frameworkflexcube_private_bankingretail_integration_busretail_eftlinkutilities_frameworkoracle_goldengate_application_adaptersfinancial_services_institutional_performance_analyticspolicy_automation_connector_for_siebelstoragetek_tape_analytics_sw_toolretail_insights_cloud_service_suiteweblogic_serverdebian_linuxhealth_sciences_information_managerflexcube_core_bankingretail_xstore_point_of_servicelog4jfinancial_services_market_risk_measurement_and_managementdata_integratorApache Log4j
CWE ID-CWE-295
Improper Certificate Validation
CVE-2020-5526
Matching Score-4
Assigner-JPCERT/CC
ShareView Details
Matching Score-4
Assigner-JPCERT/CC
CVSS Score-5.9||MEDIUM
EPSS-0.16% / 36.99%
||
7 Day CHG~0.00%
Published-31 Jan, 2020 | 03:35
Updated-04 Aug, 2024 | 08:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Action-Not Available
Vendor-fujixeroxFuji Xerox Co.,Ltd.
Product-apeosware_management_suiteAWMS Mobile App
CWE ID-CWE-295
Improper Certificate Validation
CVE-2019-6702
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.76% / 72.36%
||
7 Day CHG~0.00%
Published-17 Mar, 2019 | 17:13
Updated-04 Aug, 2024 | 20:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier.

Action-Not Available
Vendor-mastercardn/a
Product-qkr\!_with_masterpassn/a
CWE ID-CWE-295
Improper Certificate Validation
CVE-2017-5914
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.12% / 31.88%
||
7 Day CHG~0.00%
Published-05 May, 2017 | 07:04
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Action-Not Available
Vendor-dotit-corpn/a
Product-banque_zitounan/a
CWE ID-CWE-295
Improper Certificate Validation
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • Next
Details not found