CVE-2016-10511

The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS app features.

Score

CVSS 3.0 5.9 Medium

Status

Modified - support@hackerone.com

Published

2017-09-18

Last modified

2024-08-06

Weaknesses

CWE-295

Affected products

• Twitter (Twitter)

References

• http://www.securityfocus.com/bid/100904
• https://hackerone.com/reports/168538