High severity · published Sep 26, 2018
CVE-2018-17215
An information-disclosure issue was discovered in Postman through 6.3.0
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials).
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
Postman · Postman
through 6.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-17215
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-17215
Exploit
https://seclists.org/bugtraq/2018/Sep/56
Exploit
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt
More from Postman
9.8
CVE-2024-23738
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings