CVE-2017-2387

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-04-07 · updated 2026-06-17
Weakness: CWE-295

Description

The Apple Music (aka com.apple.android.music) application before 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected products

Apple Music before 2.0 for Android: 1.2.1

References

http://www.info-sec.ca/advisories/Apple-Music.html
http://www.securityfocus.com/bid/97390
https://support.apple.com/HT207605
http://www.info-sec.ca/advisories/Apple-Music.html
http://www.securityfocus.com/bid/97390
https://support.apple.com/HT207605

Get alerted when CVE-2017-2387 or the next vulnerability affects your stack