Vulnerability · Published Dec 1, 2021 · Assigned by CERTVDE

CVE-2021-34599Improper Certificate Validation in CODESYS Git

High 7.4

In plain English

A high-severity improper certificate validation in CODESYS Git from CODESYS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.

Affected products (as reported)

Vendor	Product	Versions
CODESYS	CODESYS Git	CODESYS Git – before V1.1.0.0

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=16959&token=3ce11e44a3277c4520d732ea2e630f2e06bd46ff&download x_refsource_CONFIRM