CWE-300
DiscouragedChannel Accessible by Non-Endpoint
Abstraction: Class · Status: Draft
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
95 vulnerabilities reference this CWE, most recent first.
GHSA-P788-RJ37-357W
Vulnerability from github – Published: 2020-09-01 15:26 – Updated: 2021-09-23 21:28Affected versions of ezseed-transmission download and run a script over an HTTP connection.
An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running ezseed-transmission.
Recommendation
Update to version 0.0.15 or later.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.0.14"
},
"package": {
"ecosystem": "npm",
"name": "ezseed-transmission"
},
"ranges": [
{
"events": [
{
"introduced": "0.0.10"
},
{
"fixed": "0.0.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-1000224"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:11:16Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.\n\nAn attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.\n\n\n\n## Recommendation\n\nUpdate to version 0.0.15 or later.",
"id": "GHSA-p788-rj37-357w",
"modified": "2021-09-23T21:28:12Z",
"published": "2020-09-01T15:26:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000224"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/npm:ezseed-transmission:20160729"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/114"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insecure Defaults Leads to Potential MITM in ezseed-transmission"
}
GHSA-PC5P-H8PF-MVWP
Vulnerability from github – Published: 2020-04-16 03:14 – Updated: 2023-11-01 20:54Versions of https-proxy-agent prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.
Recommendation
Upgrade to version 3.0.0 or 2.2.3.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "https-proxy-agent"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2020-04-16T03:03:19Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.\n\n\n## Recommendation\n\nUpgrade to version 3.0.0 or 2.2.3.",
"id": "GHSA-pc5p-h8pf-mvwp",
"modified": "2023-11-01T20:54:11Z",
"published": "2020-04-16T03:14:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TooTallNate/node-https-proxy-agent/commit/36d8cf509f877fa44f4404fce57ebaf9410fe51b"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/541502"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1184"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Machine-In-The-Middle in https-proxy-agent"
}
GHSA-PG5R-4RF5-R7HV
Vulnerability from github – Published: 2022-05-24 17:06 – Updated: 2024-04-04 02:46MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password.
{
"affected": [],
"aliases": [
"CVE-2019-3981"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-14T19:15:00Z",
"severity": "MODERATE"
},
"details": "MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client\u0027s authentication protocol and recover the user\u0027s username and MD5 hashed password.",
"id": "GHSA-pg5r-4rf5-r7hv",
"modified": "2024-04-04T02:46:25Z",
"published": "2022-05-24T17:06:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3981"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2020-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q5MG-3R24-HVX2
Vulnerability from github – Published: 2023-10-12 18:30 – Updated: 2025-11-04 21:30An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-32634"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-12T16:15:11Z",
"severity": "HIGH"
},
"details": "An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. An attacker can perform a local man-in-the-middle attack to trigger this vulnerability.",
"id": "GHSA-q5mg-3r24-hvx2",
"modified": "2025-11-04T21:30:44Z",
"published": "2023-10-12T18:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32634"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
},
{
"type": "WEB",
"url": "https://www.softether.org/9-about/News/904-SEVPN202301"
},
{
"type": "WEB",
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1755"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q6XX-GV82-HC4M
Vulnerability from github – Published: 2025-06-10 18:32 – Updated: 2025-06-10 18:32A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.
{
"affected": [],
"aliases": [
"CVE-2024-50568"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-10T17:19:25Z",
"severity": "MODERATE"
},
"details": "A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.",
"id": "GHSA-q6xx-gv82-hc4m",
"modified": "2025-06-10T18:32:27Z",
"published": "2025-06-10T18:32:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50568"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-058"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q8QQ-2P5P-RG44
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2023-12-14 09:28Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.
Jenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing host key validation for administrators to select the one that meets their security needs. It includes assistance for administrators to migrate to a new, more secure strategy. For more information see the plugin documentation.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.50.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:ec2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.50.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2185"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-16T22:55:37Z",
"nvd_published_at": "2020-05-06T13:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not use SSH host key validation when connecting to agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.\n\nJenkins Amazon EC2 Plugin 1.50.2 provides strategies for performing host key validation for administrators to select the one that meets their security needs. It includes assistance for administrators to migrate to a new, more secure strategy. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-unix-amis).",
"id": "GHSA-q8qq-2p5p-rg44",
"modified": "2023-12-14T09:28:43Z",
"published": "2022-05-24T17:17:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2185"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/ec2-plugin/commit/4c9f03ae202e4730fd54eda40771fa4d3873e358"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/ec2-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-05-06/#SECURITY-381"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/05/06/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Missing SSH host key validation in Jenkins Amazon EC2 Plugin"
}
GHSA-QXG4-M824-M377
Vulnerability from github – Published: 2022-05-13 01:12 – Updated: 2022-05-13 01:12A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic.
{
"affected": [],
"aliases": [
"CVE-2017-12735"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-30T19:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions \u003c V8.3). An attacker who performs a Man-in-the-Middle attack between the LOGO! BM and other devices could potentially decrypt and modify network traffic.",
"id": "GHSA-qxg4-m824-m377",
"modified": "2022-05-13T01:12:17Z",
"published": "2022-05-13T01:12:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12735"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-087240.pdf"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100561"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RCXG-WQW2-89WF
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2024-02-15 21:31A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later.
{
"affected": [],
"aliases": [
"CVE-2021-22909"
],
"database_specific": {
"cwe_ids": [
"CWE-295",
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-27T12:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later.",
"id": "GHSA-rcxg-wqw2-89wf",
"modified": "2024-02-15T21:31:25Z",
"published": "2022-05-24T19:03:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22909"
},
{
"type": "WEB",
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-018-018/cfa1566b-4bf8-427b-8cc7-8cffba3a93a4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RWR5-XR2C-7WC8
Vulnerability from github – Published: 2022-05-24 17:03 – Updated: 2023-01-09 18:30A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.
{
"affected": [],
"aliases": [
"CVE-2019-14899"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-11T15:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.",
"id": "GHSA-rwr5-xr2c-7wc8",
"modified": "2023-01-09T18:30:20Z",
"published": "2022-05-24T17:03:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14899"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14899"
},
{
"type": "WEB",
"url": "https://openvpn.net/security-advisory/no-flaws-found-in-openvpn-software"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211288"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211289"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211290"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211850"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT211931"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Dec/32"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jul/23"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jul/24"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jul/25"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Nov/20"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/08/13/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/10/07/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/07/05/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W7FP-PJ56-6XC6
Vulnerability from github – Published: 2025-03-27 18:31 – Updated: 2025-03-27 18:31IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1
could allow a user with access to the network to obtain sensitive information from CLI arguments.
{
"affected": [],
"aliases": [
"CVE-2023-38272"
],
"database_specific": {
"cwe_ids": [
"CWE-300"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-27T18:17:29Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 \n\ncould allow a user with access to the network to obtain sensitive information from CLI arguments.",
"id": "GHSA-w7fp-pj56-6xc6",
"modified": "2025-03-27T18:31:29Z",
"published": "2025-03-27T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38272"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7229212"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Always fully authenticate both ends of any communications channel.
Mitigation
Adhere to the principle of complete mediation.
Mitigation
A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.
CAPEC-466: Leveraging Active Adversary in the Middle Attacks to Bypass Same Origin Policy
An attacker leverages an adversary in the middle attack (CAPEC-94) in order to bypass the same origin policy protection in the victim's browser. This active adversary in the middle attack could be launched, for instance, when the victim is connected to a public WIFI hot spot. An attacker is able to intercept requests and responses between the victim's browser and some non-sensitive website that does not use TLS.
CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to obtain sensitive data once SSL is terminated.
CAPEC-589: DNS Blocking
An adversary intercepts traffic and intentionally drops DNS requests based on content in the request. In this way, the adversary can deny the availability of specific services or content to the user even if the IP address is changed.
CAPEC-590: IP Address Blocking
An adversary performing this type of attack drops packets destined for a target IP address. The aim is to prevent access to the service hosted at the target IP address.
CAPEC-612: WiFi MAC Address Tracking
In this attack scenario, the attacker passively listens for WiFi messages and logs the associated Media Access Control (MAC) addresses. These addresses are intended to be unique to each wireless device (although they can be configured and changed by software). Once the attacker is able to associate a MAC address with a particular user or set of users (for example, when attending a public event), the attacker can then scan for that MAC address to track that user in the future.
CAPEC-613: WiFi SSID Tracking
In this attack scenario, the attacker passively listens for WiFi management frame messages containing the Service Set Identifier (SSID) for the WiFi network. These messages are frequently transmitted by WiFi access points (e.g., the retransmission device) as well as by clients that are accessing the network (e.g., the handset/mobile device). Once the attacker is able to associate an SSID with a particular user or set of users (for example, when attending a public event), the attacker can then scan for this SSID to track that user in the future.
CAPEC-615: Evil Twin Wi-Fi Attack
Adversaries install Wi-Fi equipment that acts as a legitimate Wi-Fi network access point. When a device connects to this access point, Wi-Fi data traffic is intercepted, captured, and analyzed. This also allows the adversary to use "adversary-in-the-middle" (CAPEC-94) for all communications.
CAPEC-662: Adversary in the Browser (AiTB)
An adversary exploits security vulnerabilities or inherent functionalities of a web browser, in order to manipulate traffic between two endpoints.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.