Home

Description

SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.

PUBLISHED Reserved 2025-04-19 | Published 2025-04-19 | Updated 2025-04-21 | Assigner mitre




MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-348 Use of Less Trusted Source

Product status

Default status
unaffected

Any version before 2025-04-19
affected

References

news.ycombinator.com/item?id=43738485

bugzilla.mozilla.org/show_bug.cgi?id=1961406

cve.org (CVE-2025-43918)

nvd.nist.gov (CVE-2025-43918)

Download JSON