CVE-2015-3996

no score yetEPSS 0.8%

afnetworking project afnetworking: no CVSS score yet. EPSS 0.8% chance of exploitation in the next 30 days.

The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWE: CWE-254
Published: 2015-10-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

afnetworking_project:afnetworking

References

http://www.securityfocus.com/bid/76242
https://github.com/AFNetworking/AFNetworking/issues/2619
https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3
https://owncloud.org/security/advisory/?id=oc-sa-2015-012
http://www.securityfocus.com/bid/76242

Check your stack JSON