{"api_version":"1","generated_at":"2026-07-23T09:12:26+00:00","cve":"CVE-2017-3190","urls":{"html":"https://cve.report/CVE-2017-3190","api":"https://cve.report/api/cve/CVE-2017-3190.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-3190","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-3190"},"summary":{"title":"CVE-2017-3190","description":"Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.","state":"PUBLISHED","assigner":"certcc","published_at":"2017-12-16 02:29:10","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-295","CWE-295 CWE-295: Improper Certificate Validation"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"HIGH","vector":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.9","severity":"","vector":"AV:A/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:A/AC:M/Au:N/C:P/I:N/A:N","baseScore":2.9,"accessVector":"ADJACENT_NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/96719","name":"http://www.securityfocus.com/bid/96719","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Flash Seats for iOS CVE-2017-3190 SSL Certificate Validation Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/","name":"https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Flash Seats Mobile App for iOS fails to validate SSL certificates | Wilders Security Forums","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.kb.cert.org/vuls/id/247016","name":"https://www.kb.cert.org/vuls/id/247016","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"VU#247016 - Flash Seats Mobile App for Android and iOS fails to validate SSL certificates","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3190","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3190","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Flash Seats","product":"Flash Seats Mobile App","version":"affected Android version 1.7.9 and earlier","platforms":[]},{"source":"CNA","vendor":"Flash Seats","product":"Flash Seats Mobile App","version":"affected iOS version 1.9.51 and earlier","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"3190","vulnerable":"1","versionEndIncluding":"1.7.9","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"axs","cpe5":"flash_seats","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"android","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"3190","vulnerable":"1","versionEndIncluding":"1.9.51","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"axs","cpe5":"flash_seats","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"iphone_os","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2017","cve_id":"3190","cve":"CVE-2017-3190","epss":"0.000970000","percentile":"0.264080000","score_date":"2026-05-18","updated_at":"2026-05-19 00:10:21"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T14:16:28.226Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/"},{"name":"VU#247016","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"https://www.kb.cert.org/vuls/id/247016"},{"name":"96719","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/96719"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Flash Seats Mobile App","vendor":"Flash Seats","versions":[{"status":"affected","version":"Android version 1.7.9 and earlier"},{"status":"affected","version":"iOS version 1.9.51 and earlier"}]}],"datePublic":"2017-03-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-295","description":"CWE-295: Improper Certificate Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2017-12-15T13:57:01.000Z","orgId":"37e5125f-f79b-445b-8fad-9564f167944b","shortName":"certcc"},"references":[{"tags":["x_refsource_MISC"],"url":"https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/"},{"name":"VU#247016","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"https://www.kb.cert.org/vuls/id/247016"},{"name":"96719","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/96719"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cert@cert.org","ID":"CVE-2017-3190","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Flash Seats Mobile App","version":{"version_data":[{"version_value":"Android version 1.7.9 and earlier"},{"version_value":"iOS version 1.9.51 and earlier"}]}}]},"vendor_name":"Flash Seats"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-295: Improper Certificate Validation"}]}]},"references":{"reference_data":[{"name":"https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/","refsource":"MISC","url":"https://www.wilderssecurity.com/threads/flash-seats-mobile-app-for-ios-fails-to-validate-ssl-certificates.392553/"},{"name":"VU#247016","refsource":"CERT-VN","url":"https://www.kb.cert.org/vuls/id/247016"},{"name":"96719","refsource":"BID","url":"http://www.securityfocus.com/bid/96719"}]}}}},"cveMetadata":{"assignerOrgId":"37e5125f-f79b-445b-8fad-9564f167944b","assignerShortName":"certcc","cveId":"CVE-2017-3190","datePublished":"2017-12-15T14:00:00.000Z","dateReserved":"2016-12-05T00:00:00.000Z","dateUpdated":"2024-08-05T14:16:28.226Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-12-16 02:29:10","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-295","CWE-295 CWE-295: Improper Certificate Validation"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:A/AC:M/Au:N/C:P/I:N/A:N","baseScore":2.9,"accessVector":"ADJACENT_NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":5.5,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:axs:flash_seats:*:*:*:*:*:iphone_os:*:*","versionEndIncluding":"1.9.51","matchCriteriaId":"2C8B36E3-988F-4D5F-A01B-9AD129F8527C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:axs:flash_seats:*:*:*:*:*:android:*:*","versionEndIncluding":"1.7.9","matchCriteriaId":"54B084CA-7F1E-4CED-BCF7-3035DD95CD89"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"3190","Ordinal":"1","Title":"CVE-2017-3190","CVE":"CVE-2017-3190","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"3190","Ordinal":"1","NoteData":"Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.","Type":"Description","Title":"CVE-2017-3190"},{"CveYear":"2017","CveId":"3190","Ordinal":"2","NoteData":"2017-12-15","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"3190","Ordinal":"3","NoteData":"2017-12-15","Type":"Other","Title":"Modified"}]}}}