CWE-295
Overview
- CWE ID
- 295
- CWE Name
- Improper Certificate Validation
- CWE Abstraction
- Base
- CWE structure
- Simple
- CWE Status
- Draft
Description
The software does not validate, or incorrectly validates, a certificate.
Extended Description
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or