CVE-2014-3566: POODLE
Is CVE-2014-3566 real, exploitable, or a false positive? Here's the community verdict.
signals
public sources
Lower base score, but a notable exploitation probability. Don't dismiss it on score alone.
public exploits
links to sources — we don’t host codeUnverified proof-of-concept code has been published. It may or may not be functional — assess before relying on it.
baseline read
auto · not a community verdict
Low signal — verdict needed
Few public signals point to active risk. Whether a scanner hit here is a true or false positive depends on your version and config — community verdicts decide.
Based on CVSS · FIRST EPSS
Confirm or dispute →CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
References
Published
Embed this verdict
[](https://www.truepositive.app/cve/CVE-2014-3566)<a href="https://www.truepositive.app/cve/CVE-2014-3566"><img src="https://www.truepositive.app/cve/CVE-2014-3566/badge.svg" alt="TruePositive verdict for CVE-2014-3566"></a>Live badge that updates automatically as the community verdict changes.
Community ground truth
Be the first practitioner to weigh in
So far this is only TruePositive's editorial baseline from public sources. Add your real-world verdict below — it becomes the signal the next person triaging this relies on.
🥇 The first 50 practitioners to contribute earn a Founding Contributor badge.
In your experience, is this finding real and exploitable?
awaiting field verdictsCurated baseline: TruePositive's read from public sources is Real, not exploitable in practice — a starting point, not a community verdict.
No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.
Field notes & remediation
Verdicts are the quick signal. Notes are the evidence and fixes behind them.
- 0
POODLE is a real flaw in the old SSLv3 protocol, but exploiting it in practice needs an active man-in-the-middle position and many repeated requests to recover data one byte at a time. In 2014 it mattered, but today it almost always shows up as a compliance or scanner finding that flags SSLv3 still being enabled, rather than a real incident.
Who is affected: servers and clients that still allow SSLv3.
How to check: test whether SSLv3 is enabled on the service. If it is already disabled, the finding does not apply.
Commonly flagged by: Nessus, Qualys, OpenVAS, testssl.
- 0
Disable SSLv3 everywhere. That is the correct fix and it clears the finding no matter how practical the attack is. During any transition you can enable TLS_FALLBACK_SCSV to stop downgrade attacks, but the real goal is simply to turn SSLv3 off.
Add a field note or remediationoptional
Related CVEs
Same weakness: CWE-310.