CVE-2014-6708

CVE-2014-6708 describes a critical vulnerability in the Sporting Club Uphoria Android application (version 2.1.0), specifically affecting the sportinginnovations utah_jazz product. The application fails to properly validate X.509 certificates from SSL servers, enabling man-in-the-middle (MITM) attackers to spoof legitimate servers. This flaw could lead to the interception and compromise of sensitive user information. The vulnerability carries a CVSS score of 5.4, indicating a medium severity. An attacker could exploit this remotely (AV:A) with moderate complexity (AC:M), potentially leading to partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). The underlying weakness is categorized as CWE-310, "Cryptographic Issues." Currently, there is no evidence of active exploitation, and it is not listed in the CISA KEV catalog. No public exploit code, such as Metasploit or ExploitDB modules, is available, and there is no community discussion or media coverage surrounding this CVE.