CME-404
Certificate Pinning
Description
Application pins expected TLS certificate fingerprints or public keys, preventing MitM attacks using rogue or compromised certificate authorities.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | MitM requires compromising the specific pinned certificate, not just any CA |
CWE Relationships
Verification
Application-specific: check for pin configuration in app config or HTTP headers