CVEvulnerability

CVE-2014-6611

4.3 MEDIUM Published 2014-10-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-10-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream.

Affected configurations

• blackberry blackberry world (<= 5.1.0.52) • blackberry blackberry os 10.3.0 • blackberry blackberry world (<= 5.0.0.262) • blackberry blackberry os 10.2.1 • blackberry blackberry world (<= 5.0.0.261) • blackberry blackberry os 10.2.0

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References