Lucene search
HistoryNov 04, 2012 - 10:55 p.m.
CVE-2012-5787
paypal
merchant
sdk
x.509
certificate
ssl
security vulnerability
nvd
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
47.8%
The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected configurations
Node
paypalmerchant_sdkMatch-
| CPE | Name | Operator | Version |
|---|---|---|---|
| paypal:merchant_sdk | paypal merchant sdk | eq | - |
Related
cvelist
cvelist
CVE-2012-5787
2012-11-04 22:00:00
nvd
nvd
CVE-2012-5787
2012-11-04 22:55:03
prion
prion
Code injection
2012-11-04 22:55:00
5.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
47.8%
Related for CVE-2012-5787