Description

When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.

Proof of Concept

1. Add package with a link whose host's SSL certificate is invalid. E.g. https://self-signed.badssl.com/
2. Go to the Files tab and see there is the content of the above-mentioned link.

Impact

This vulnerability is capable of allowing an attacker to intercept data sent over HTTPS connections .