CVE-2017-5902

CVE-2017-5902 describes a critical vulnerability in the PayQuicker app 1.0.0 for iOS, where the application fails to validate X.509 certificates from SSL servers. This flaw allows man-in-the-middle (MiTM) attackers to spoof legitimate servers, potentially leading to the compromise of sensitive user information through crafted certificates. Rated with a CVSS score of 5.9 (MEDIUM), the vulnerability has a network attack vector and high confidentiality impact, though it requires high attack complexity. While there is no evidence of active exploitation, nor publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered some community discussion, with 3 mentions across various platforms.