The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11).
References
| Link | Resource |
|---|---|
| https://apps.apple.com/us/app/planet-fitness-workouts/id399857015 | Product |
| https://dontvacuum.me/bugs/pf/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
28 Feb 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11). |
30 Sep 2024, 13:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://dontvacuum.me/bugs/pf/ - Exploit, Third Party Advisory | |
| References | () https://apps.apple.com/us/app/planet-fitness-workouts/id399857015 - Product | |
| CWE | CWE-295 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.9 |
| CPE | cpe:2.3:a:planetfitness:planet_fitness_workouts:*:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* cpe:2.3:o:google:android:-:*:*:*:*:*:*:* |
|
| First Time |
Planetfitness planet Fitness Workouts
Google android Apple Apple iphone Os Planetfitness |
23 Sep 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-23 20:15
Updated : 2025-02-28 18:15
NVD link : CVE-2024-43201
Mitre link : CVE-2024-43201
JSON object : View
Products Affected
- android
planetfitness
- planet_fitness_workouts
apple
- iphone_os
CWE
CWE-295
Improper Certificate Validation