CVE-2022-28352

4.8 mediumEPSS 0.4%

WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS options are changed, which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 37% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2022-04-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

weechat:weechat

References

https://github.com/weechat/weechat/issues/1763
https://weechat.org/doc/security/WSA-2022-1/
https://github.com/weechat/weechat/issues/1763
https://weechat.org/doc/security/WSA-2022-1/

Check your stack JSON