CVE-2017-2387

CVE-2017-2387 describes a vulnerability in the Apple Music application for Android (versions prior to 2.0) where it fails to properly validate X.509 certificates from SSL servers. This flaw allows a man-in-the-middle attacker to spoof legitimate servers using a crafted certificate, potentially leading to the disclosure of sensitive user information. Rated with a CVSS score of 4.8 (Medium), exploitation requires an adjacent network attack, high attack complexity, and user interaction, but could result in high confidentiality impact. While there is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, the vulnerability has garnered some community discussion and media coverage.