CVE-2014-5239

2014-08-1405:01:50

CWE-310

[email protected]

web.nvd.nist.gov

microsoft

outlook.com

android

man-in-the-middle

ssl

certificate

security

vulnerability

cve-2014-5239

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

5.9 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.7%

JSON

The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Affected configurations

NVD

Node

microsoftoutlook.comRange≤7.8.2.12.49.6434android

microsoftoutlook.comMatch7.8.2.10.47.7365android

microsoftoutlook.comMatch7.8.2.11.48.4848android

microsoftoutlook.comMatch7.8.2.12.49.0430android

microsoftoutlook.comMatch7.8.2.12.49.5701android

CPENameOperatorVersion
microsoft:outlook.commicrosoft outlook.comle7.8.2.12.49.6434
microsoft:outlook.commicrosoft outlook.comeq7.8.2.10.47.7365
microsoft:outlook.commicrosoft outlook.comeq7.8.2.11.48.4848
microsoft:outlook.commicrosoft outlook.comeq7.8.2.12.49.0430
microsoft:outlook.commicrosoft outlook.comeq7.8.2.12.49.5701

CPE	Name	Operator	Version
microsoft:outlook.com	microsoft outlook.com	le	7.8.2.12.49.6434
microsoft:outlook.com	microsoft outlook.com	eq	7.8.2.10.47.7365
microsoft:outlook.com	microsoft outlook.com	eq	7.8.2.11.48.4848
microsoft:outlook.com	microsoft outlook.com	eq	7.8.2.12.49.0430
microsoft:outlook.com	microsoft outlook.com	eq	7.8.2.12.49.5701