CVE-2012-2993

Опубликовано: 18 сент. 2012

Источник: nvd

CVSS3: 5.9

CVSS2: 2.6

EPSS Средний

Описание

Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.

Ссылки

http://osvdb.org/85619
Broken Link
http://www.kb.cert.org/vuls/id/389795
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/55569
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1027541
Broken Link
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/78620
Third Party Advisory
VDB Entry
http://osvdb.org/85619
Broken Link
http://www.kb.cert.org/vuls/id/389795
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/55569
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id?1027541
Broken Link
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/78620
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:microsoft:windows_phone_7_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:microsoft:windows_phone_7:-:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.1469

Средний

5.9 Medium

CVSS3

2.6 Low

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-q94c-7f46-5326