CVE-2018-17215

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-26 · updated 2026-06-17
Weakness: CWE-295

Description

An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately, the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus, all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example, user credentials).

Affected products

Postman: through 6.3.0

References

https://seclists.org/bugtraq/2018/Sep/56
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt
https://seclists.org/bugtraq/2018/Sep/56
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-016.txt

Get alerted when CVE-2018-17215 or the next vulnerability affects your stack