Security readout for executives and security teams
Plain-English summary
The listed Indiana Voters iOS app version did not properly check whether it was talking to the real server. A person positioned between the app and network could impersonate the server and see sensitive data. Business urgency depends on whether this legacy app version is still installed or supported.
Executive priority
Treat this as a targeted legacy mobile exposure review, not an emergency unless the vulnerable app is still in use. Prioritize inventory confirmation and removal because the available sources do not identify an official patch or active exploitation.
Technical view
CVE-2017-8935 reports missing X.509 certificate verification in Quest Information Systems Indiana Voters app 1.1.24 for iOS. The impact is server spoofing and possible disclosure of TLS-protected sensitive information through a man-in-the-middle position using a crafted certificate. No CVSS, CWE, or official fixed version is provided in the source bundle.
Likely exposure
Likely exposure is limited to users or managed devices that still have Indiana Voters iOS app 1.1.24 installed. Current exposure is unclear because the provided sources do not confirm app availability, affected server endpoints, vendor remediation, or whether later versions fixed the issue.
Exploitation context
The CVE describes man-in-the-middle exploitation and the public reference discusses silent interception of TLS-protected app data. The source bundle does not cite CISA KEV listing, active exploitation, public weaponization, or exploitation at scale.
Researcher notes
Evidence is sparse but specific: the CVE names app version 1.1.24 and the missing certificate validation behavior. The affected-product metadata is otherwise n/a, and no CVSS is supplied. Avoid assuming other Quest products, current app versions, or remediation details without additional vendor evidence.
Mitigation direction
- Inventory managed iOS devices for Indiana Voters app version 1.1.24.
- Remove the vulnerable app version where it remains installed.
- Check vendor or app store guidance for a fixed or replacement version.
- Advise users not to submit sensitive data through unsupported legacy app versions.
Validation and detection
- Confirm whether the app and exact version exist in MDM or endpoint inventory.
- Review mobile app assessment records for TLS certificate validation findings.
- Check vendor, app store, or owner guidance for remediation status.
- Document whether any sensitive workflows used the affected app version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-8935 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://medium.com/%40chronic_9612/follow-up-76-popular-apps-confirmed-vulnerable-to-silent-interception-of-tls-protected-data-64185035029fCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.