CVE-2018-1153 Security feature bypass in Burp Suite Community Edition
Man-in-the-middle attackers can view or modify HTTPS traffic due to missing server certificate validation in Burp Suite Community Edition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1153?
CVE-2018-1153 is a high-severity vulnerability in Tenable Burp Suite Community Edition, published on 18 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Burp Suite Community Edition 1.7.32 and 1.7.33 fail to validate the server certificate in a couple of HTTPS requests which allows a man in the middle to modify or view traffic.
Weakness: CWE-295
Which versions are affected by CVE-2018-1153?
It affects 1 product.
Products include Portswigger Burp Suite.
How do I fix CVE-2018-1153?
No fix has been published for CVE-2018-1153 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-1153 being exploited?
There is no known exploitation of CVE-2018-1153 in the wild and no public exploit code.
Other vulnerabilities in Tenable Burp Suite Community Edition
Sources
Also known as GHSA-3w65-74c3-p8jp.