PT-2012-2213
CVE-2011-5236
·
تاريخ النشر
2012-11-06
·
تاريخ التحديث
2012-11-06
الوصف من
CVSS 2.0
5.8
متوسطةالمقاييسAV:N/AC:M/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions
Moneris eSelectPlus version 2.03
Description
The issue arises from the failure of the Moneris eSelectPlus 2.03 PHP API to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Recommendations
For Moneris eSelectPlus version 2.03, consider implementing certificate validation to ensure the server hostname matches the domain name in the certificate's Common Name (CN) or subjectAltName field, as a temporary workaround to mitigate the risk of man-in-the-middle attacks.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾