Lucene search

[email protected]CVE-2012-5793

HistoryNov 04, 2012 - 10:55 p.m.

CVE-2012-5793

2012-11-0422:55:03

CWE-20

[email protected]

web.nvd.nist.gov

oscommerce

authorize.net

module

server hostname

verification bypass

ssl

x.509

certificate

security issue

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.7%

JSON

The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected configurations

NVD

Node

harald_ponce_de_leonauthorize.netMatch-

oscommerceoscommerceMatch-

CPENameOperatorVersion
harald_ponce_de_leon:authorize.netharald ponce de leon authorize.neteq-
oscommerce:oscommerceoscommerceeq-

CPE	Name	Operator	Version
harald_ponce_de_leon:authorize.net	harald ponce de leon authorize.net	eq	-
oscommerce:oscommerce	oscommerce	eq	-

References

www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

exchange.xforce.ibmcloud.com/vulnerabilities/79978

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.7%

JSON

Related for CVE-2012-5793

prion1 nvd1 cvelist1