Vulnerability Description
Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Basware | Banking | <= 8.90.07 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2015/Jul/120
- https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuv
- http://seclists.org/fulldisclosure/2015/Jul/120
- https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuv
FAQ
What is CVE-2015-0943?
CVE-2015-0943 is a vulnerability with a CVSS score of 5.8 (MEDIUM). Basware Banking (Maksuliikenne) before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user crede...
How severe is CVE-2015-0943?
CVE-2015-0943 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-0943?
Check the references section above for vendor advisories and patch information. Affected products include: Basware Banking.