{"cve":"CVE-2015-8960","nvd":{"published":"2016-09-21T02:59:00.133","modified":"2026-06-17T00:35:34.183","status":"Modified","description":"The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the \"Key Compromise Impersonation (KCI)\" issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-295"],"references":["http://twitter.com/matthew_d_green/statuses/630908726950674433","http://www.openwall.com/lists/oss-security/2016/09/20/4","http://www.securityfocus.com/bid/93071","https://kcitls.org","https://security.netapp.com/advisory/ntap-20180626-0002/"],"products":["ietf:transport_layer_security","netapp:clustered_data_ontap_antivirus_connector","netapp:data_ontap_edge","netapp:host_agent","netapp:oncommand_shift","netapp:plug-in_for_symantec_netbackup","netapp:smi-s_provider","netapp:snap_creator_framework","netapp:snapdrive","netapp:snapmanager","netapp:snapprotect","netapp:solidfire_\\&_hci_management_node","netapp:system_setup"],"source":"nvd","synced_at":"2026-10-19T20:40:10.783210791+00:00"},"epss":{"cve":"CVE-2015-8960","score":0.01947,"percentile":0.80202,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}