CVE-2011-5240

Magento 1.5 and 1.6.2 - Man-in-the-Middle Attack via Unverified SSL Certificate

Title source: llm
STIX 2.1

Description

Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (1)

Core 1
Core References
Various Sources x_refsource_misc
http://www.unrest.ca/peerjacking

Scores

EPSS 0.0061
EPSS Percentile 45.1%

Details

CWE
CWE-20
Status published
Products (2)
magentocommerce/magento 1.5
magentocommerce/magento 1.6.2
Published Nov 06, 2012
Tracked Since Feb 18, 2026