CVE-2021-20833 Weak cryptography in SNKRDUNK Market Place App for iOS
Attackers can intercept and modify encrypted traffic in the SNKRDUNK iOS app due to improper server certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20833?
CVE-2021-20833 is a high-severity vulnerability in SODA, Inc. SNKRDUNK Market Place App for iOS, published on 13 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly, which allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate.
Weakness: CWE-295
Which versions are affected by CVE-2021-20833?
It affects 1 product.
Products include Soda-Inc Snkrdunk.
How do I fix CVE-2021-20833?
No fix has been published for CVE-2021-20833 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20833 being exploited?
There is no known exploitation of CVE-2021-20833 in the wild and no public exploit code.
Sources
Also known as GHSA-9cmh-266p-f4xf.