CVE-2013-7397Not scoredCWE-345

CVE-2013-7397: Async-Http-Client Project vulnerability

Async-Http-Client Project · Async-Http-Client

Fixed in 1.9.0 · Affected: Async-Http-Client Project before 1.9.0 · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.0%probability of exploitation in the next 30 days

63rd percentile

050100

Higher than 63% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Insufficient Verification of Data Authenticity · Cryptography
Vendor: Async-Http-Client Project
Published: June 2015
Band: Unlikely (under 1%), June 2015

CoverageNo articles yet

No CyberSIXT article names CVE-2013-7397 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.