Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

AFNetworking before 2.5.3 may accept fake SSL certificates

CVE-2015-3996 · published 11 years ago
Summary

The iOS version of ownCloud uses an older AFNetworking library that does not check that a server’s certificate matches its domain name. This lets an attacker present a legitimate‑looking certificate and intercept data. Update AFNetworking to version 2.5.3 or later, or configure it to validate domain names, to restore proper protection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
afnetworking_project afnetworking <= 2.5.2
cpe:2.3:a:afnetworking_project:afnetworking:*:*:*:*:*:*:*:*
Original advisory text
The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a s...
The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-2547PK - Security Features
Timeline
Published27 Oct 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-3996 · NVD
Track software like this
Free during beta