CVE-2018-1000096 describes a critical Missing SSL certificate validation vulnerability in all versions of the brianleroux tiny-json-http library since October 29, 2016. This flaw exposes users to severe man-in-the-middle attacks, allowing attackers to intercept and potentially manipulate sensitive data. With a CVSS score of 8.1 (HIGH), the vulnerability is network-exploitable with high impact on confidentiality, integrity, and availability, though it requires high attack complexity. There is no evidence of active exploitation, nor are there known public exploits in Metasploit, Nuclei, or ExploitDB. Despite its high severity, community discussion and media coverage are limited, with only one mention and one article identified.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.0.0, <= 7.0.0CPE matchmatch criteria | cpe:2.3:a:tiny-json-http_project:tiny-json-http:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.