CVE-2013-2073

2014-05-0201:59:00

CWE-20

[email protected]

web.nvd.nist.gov

transifex

cli

security vulnerability

man-in-the-middle attack

x.509 certificates

spoofing

nvd

cve-2013-2073

6.1 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

35.0%

JSON

Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.

CPENameOperatorVersion
transifex:transifextransifexeq0.5
transifex:transifextransifexeq0.3
transifex:transifextransifexeq0.1
transifex:transifextransifexeq0.2
transifex:transifextransifexeq0.6
transifex:transifextransifexle0.8
transifex:transifextransifexeq0.4
transifex:transifextransifexeq0.7

CPE	Name	Operator	Version
transifex:transifex	transifex	eq	0.5
transifex:transifex	transifex	eq	0.3
transifex:transifex	transifex	eq	0.1
transifex:transifex	transifex	eq	0.2
transifex:transifex	transifex	eq	0.6
transifex:transifex	transifex	le	0.8
transifex:transifex	transifex	eq	0.4
transifex:transifex	transifex	eq	0.7