Lucene search
HistoryNov 04, 2012 - 10:55 p.m.
CVE-2012-5804
cybersource
ubercart
cve-2012-5804
nvd
ssl
man-in-the-middle attack
x.509 certificate
7.3 High
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
39.4%
The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ubercart:ubercart | ubercart | eq | - |
| cybersource_module_project:cybersource | cybersource module project cybersource | eq | - |
7.3 High
AI Score
Confidence
Low
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
0.001 Low
EPSS
Percentile
39.4%
Related for CVE-2012-5804