CVE-2015-3996

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.84%

Published

Oct 27, 2015

Modified

May 6, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Weaknesses (CWE)

CWE-254

Affected Products (1)

afnetworking_project · afnetworkingvulnerable

References (8)

http://www.securityfocus.com/bid/76242

https://github.com/AFNetworking/AFNetworking/issues/2619

https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3

https://owncloud.org/security/advisory/?id=oc-sa-2015-012

Vendor Advisory

http://www.securityfocus.com/bid/76242

https://github.com/AFNetworking/AFNetworking/issues/2619

https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3

https://owncloud.org/security/advisory/?id=oc-sa-2015-012

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs