CVE-2011-5242

tmhOAuth < 0.61 - Man-in-the-Middle Attack via Unverified X.509 Certificate Hostname

Title source: llm
STIX 2.1

Description

tmhOAuth before 0.61 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (2)

Core 2
Core References
Various Sources x_refsource_misc
http://www.unrest.ca/peerjacking

Scores

EPSS 0.0052
EPSS Percentile 40.6%

Details

CWE
CWE-20
Status published
Products (17)
themattharris/tmhoauth 0.2
themattharris/tmhoauth 0.3
themattharris/tmhoauth 0.4
themattharris/tmhoauth 0.5
themattharris/tmhoauth 0.11
themattharris/tmhoauth 0.12
themattharris/tmhoauth 0.13
themattharris/tmhoauth 0.14
themattharris/tmhoauth 0.51
themattharris/tmhoauth 0.52
... and 7 more
Published Nov 06, 2012
Tracked Since Feb 18, 2026