CVE-2014-3566: POODLE
Is CVE-2014-3566 real, exploitable, or a false positive? Here's the community verdict.
Community verdict: No field verdicts yet. Be the first practitioner to weigh in.
signals
public sources
Lower base score, but a notable exploitation probability. Don't dismiss it on score alone.
cisa ssvc
CISA Vulnrichment · assessed
CISA decision, by how critical the affected system is to you:
- low impact → Track
- medium impact → Track
- high impact → Track
Track: normal patch cycle · Track*: watch closely · Attend: patch sooner · Act: patch now. About SSVC ↗
public exploits
links to sources — we don’t host codeUnverified proof-of-concept code has been published. It may or may not be functional — assess before relying on it.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2014-3566)<a href="https://www.truepositive.app/cve/CVE-2014-3566"><img src="https://www.truepositive.app/cve/CVE-2014-3566/badge.svg" alt="TruePositive verdict for CVE-2014-3566"></a>Live badge that updates automatically as the community verdict changes.
timeline
- CISA SSVC assessment · exploitation: none
- Published by NVD
Score and exploit changes tracked since .
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is Real, not exploitable in practice — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
POODLE is a real flaw in the old SSLv3 protocol, but exploiting it in practice needs an active man-in-the-middle position and many repeated requests to recover data one byte at a time. In 2014 it mattered, but today it almost always shows up as a compliance or scanner finding that flags SSLv3 still being enabled, rather than a real incident.
Who is affected: servers and clients that still allow SSLv3.
How to check: test whether SSLv3 is enabled on the service. If it is already disabled, the finding does not apply.
Commonly flagged by: Nessus, Qualys, OpenVAS, testssl.
- 0
Disable SSLv3 everywhere. That is the correct fix and it clears the finding no matter how practical the attack is. During any transition you can enable TLS_FALLBACK_SCSV to stop downgrade attacks, but the real goal is simply to turn SSLv3 off.