title: Improper Certificate Validation in CODESYS Git
description: Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default, so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified, the server connection is vulnerable to a man-in-the-middle attack.
problem types: CWE-295 Improper Certificate Validation
affected:
{
product: CODESYS Git
vendor: CODESYS
versions:
lessThan: V1.1.0.0, status: affected, version: CODESYS Git, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
solutions: CODESYS GmbH has released CODESYS Git V1.1.0.0 to solve this vulnerability issue.
CODESYS Git V1.1.0.0 can be downloaded and installed directly with the CODESYS Installer. CODESYS Git
requires a CODESYS Development System version of V3.5.17.0 or newer.