CVE-2011-5236

Name of the Vulnerable Software and Affected Versions Moneris eSelectPlus version 2.03

Description The issue arises from the failure of the Moneris eSelectPlus 2.03 PHP API to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Recommendations For Moneris eSelectPlus version 2.03, consider implementing certificate validation to ensure the server hostname matches the domain name in the certificate's Common Name (CN) or subjectAltName field, as a temporary workaround to mitigate the risk of man-in-the-middle attacks.