PT-2012-2213 · Moneris · Moneris Eselectplus

Publicado 2012-11-06 · Atualizado 2012-11-06 · CVE-2011-5236

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Moneris eSelectPlus version 2.03

Description The issue arises from the failure of the Moneris eSelectPlus 2.03 PHP API to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Recommendations For Moneris eSelectPlus version 2.03, consider implementing certificate validation to ensure the server hostname matches the domain name in the certificate's Common Name (CN) or subjectAltName field, as a temporary workaround to mitigate the risk of man-in-the-middle attacks.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-5236

Produtos afetados

Moneris Eselectplus

Referências · 2

• http://unrest.ca/peerjacking · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5236 · Nota de Segurança