CVE-2025-65827
BaseFortify
Publication date: 2025-12-10
Last updated on: 2025-12-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| meatmeet | meatmeet | 1.1.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the mobile application allows unencrypted (clear text) traffic to all domains and communicates with its API server over HTTP instead of HTTPS. This means an attacker positioned upstream in the network can intercept the data being sent, view its contents, and even modify the requests while they are in transit. This can lead to serious security issues such as account compromise if authentication tokens or hashed credentials are intercepted.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should disable clear text traffic by configuring the mobile application to use HTTPS instead of HTTP for all communications with the API server. This prevents interception and modification of traffic by adversaries. Additionally, avoid sending sensitive information such as authentication tokens or passwords hashed with weak algorithms like MD5 over unencrypted channels.
How can this vulnerability impact me? :
The vulnerability can lead to a total compromise of the user's account. An attacker intercepting the traffic can steal active authentication tokens or crack the MD5 hash sent during login, allowing them to impersonate the user, access sensitive information, and perform unauthorized actions within the application.