Security readout for executives and security teams
Plain-English summary
CVE-2017-11706 exposed Boozt Fashion Android app users because versions before 2.3.4 did not use SSL for login. Someone able to observe the user’s network traffic could read credentials. This is mainly a risk for organizations with users who installed or supported that app during the affected period.
Executive priority
Treat as high priority only if the organization had users, managed devices, or customer support exposure involving this app. Otherwise, document as historical third-party mobile risk.
Technical view
The issue affects the Boozt Fashion Android application before 2.3.4. Login traffic lacked SSL, allowing a remote network observer to sniff credentials. The bundle notes the vendor initially treated HTTPS-only checkout as acceptable, then changed the app to enable SSL logins. No CVSS, CWE, CPE, or KEV entry is provided.
Likely exposure
Exposure is limited to Boozt Fashion Android app versions before 2.3.4, especially when used on observable or untrusted networks. The source bundle does not identify other affected products or platforms.
Exploitation context
No active exploitation is cited, and KEV is false. Exploitation depends on network visibility into a user’s traffic; the disclosed impact is credential reading from non-SSL login traffic.
Researcher notes
The evidence is concise and old. The key facts are version boundary, missing SSL for login, credential exposure by sniffing, and later SSL enablement. Do not infer broader Boozt services, checkout exposure, or exploit campaigns from this bundle.
Mitigation direction
- Upgrade the Boozt Fashion Android app to version 2.3.4 or later.
- Verify current vendor guidance for any remaining supported versions.
- Rotate credentials for users who used affected versions on untrusted networks.
- Remove unsupported or obsolete affected app versions from managed devices.
Validation and detection
- Inventory Android devices for Boozt Fashion app versions before 2.3.4.
- Confirm login requests use HTTPS/TLS in current approved app versions.
- Check MDM or app store records for historical affected-version deployment.
- Review account activity for users known to have used affected versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-11706 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wwws.nightwatchcybersecurity.com/2017/07/27/boozt-fashion-android-app-didnt-use-ssl-for-login-cve-2017-11706/CVE reference · x_refsource_MISC
- https://hackerone.com/reports/166712CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.