CVE-2014-7104

CVE-2014-7104 describes a critical vulnerability in the gymnoOVP (iOVP) Android application version 1.2, developed by johtru. The application fails to properly validate X.509 certificates from SSL servers, making it susceptible to man-in-the-middle (MitM) attacks. An attacker could exploit this flaw to spoof legitimate servers, intercept sensitive user data, and potentially inject malicious content. The vulnerability carries a CVSS score of 5.4, indicating a medium severity. It requires adjacent network access (AV:A) and moderate attack complexity (AC:M), but no authentication (Au:N) is needed. The potential impact includes partial compromise of confidentiality, integrity, and availability (C:P/I:P/A:P). Despite its potential impact, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. The CVE has garnered minimal community discussion and media coverage, suggesting a low level of public awareness or concern.