CVE-2025-43918

MEDIUM EPSS 0.5%

Published Apr 19, 20251y ago · Modified Jun 17, 20262w ago

6.4 CVSS 3.1

Medium

Published Apr 19, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that domain.

CVSS Details

Base Score

6.4

Exploitability

3.1

Impact

2.7

Vector string

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

0.5% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-348

References 2

bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1961406
news.ycombinator.com https://news.ycombinator.com/item?id=43738485

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.