CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References
Link | Resource |
---|---|
http://www.unrest.ca/peerjacking |
Configurations
Configuration 1 (hide)
|
Information
Published : 2012-11-06 04:21
Updated : 2012-11-06 04:21
NVD link : CVE-2011-5239
Mitre link : CVE-2011-5239
JSON object : View
CWE
CWE-20
Improper Input Validation
Products Affected
civicrm
- civicrm