Lucene search
HistoryOct 03, 2022 - 4:15 p.m.
CVE-2011-5238
cve-2011-5238
ssl
server spoofing
google checkout
php
sample code
vulnerability
6.7 Medium
AI Score
Confidence
High
5.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
36.3%
google-checkout-php-sample-code before 1.3.2 does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected configurations
Node
googlecheckout-phpRange≤1.3.1
ORgooglecheckout-phpMatch1.2
ORgooglecheckout-phpMatch1.2beta
ORgooglecheckout-phpMatch1.2.1beta
ORgooglecheckout-phpMatch1.2.5
ORgooglecheckout-phpMatch1.2.5a
ORgooglecheckout-phpMatch1.3.0
Related
nvd
nvd
CVE-2011-5238
2012-11-06 12:21:26
prion
prion
Code injection
2012-11-06 12:21:00
cvelist
cvelist
CVE-2011-5238
2022-10-03 16:15:11
6.7 Medium
AI Score
Confidence
High
5.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
36.3%
Related for CVE-2011-5238