ebay- PrestaShop module vulnerability (CVE-2012-5800)

Moduleebay

Score

5.8 Medium

Date publish

04-11-2012

Versiones afectadas

  • No versions found.

Description

The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References

Metrics

cvssMetricV2
sourcenvd@nist.gov
typePrimary
version2.0
vectorStringAV:N/AC:M/Au:N/C:P/I:P/A:N
baseScore5.8
accessVectorNETWORK
accessComplexityMEDIUM
authenticationNONE
confidentialityImpactPARTIAL
integrityImpactPARTIAL
availabilityImpactNONE
baseSeverityMEDIUM
exploitabilityScore8.6
impactScore4.9
acInsufInfoFalse
obtainAllPrivilegeFalse
obtainUserPrivilegeFalse
obtainOtherPrivilegeFalse
userInteractionRequiredFalse
Scroll al inicio