CVE-2013-7110

2014-05-0201:59:00

CWE-20

[email protected]

web.nvd.nist.gov

transifex

cve-2013-7110

security

man-in-the-middle

x.509 certificate

data transfer

vulnerability

6.3 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

35.0%

JSON

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.

CPENameOperatorVersion
transifex:transifextransifexeq0.5
transifex:transifextransifexeq0.3
transifex:transifextransifexeq0.1
transifex:transifextransifexeq0.8
transifex:transifextransifexeq0.2
transifex:transifextransifexeq0.6
transifex:transifextransifexle0.9
transifex:transifextransifexeq0.4
transifex:transifextransifexeq0.7

CPE	Name	Operator	Version
transifex:transifex	transifex	eq	0.5
transifex:transifex	transifex	eq	0.3
transifex:transifex	transifex	eq	0.1
transifex:transifex	transifex	eq	0.8
transifex:transifex	transifex	eq	0.2
transifex:transifex	transifex	eq	0.6
transifex:transifex	transifex	le	0.9
transifex:transifex	transifex	eq	0.4
transifex:transifex	transifex	eq	0.7