SSL Spoofing Vulnerability in Zen Cart by Zen Asset Management
CVE-2012-5808

Currently unrated

Key Information:

Vendor

Zen-cart

Status
Zen Cart
Linkpoint
Vendor
CVE Published:
4 November 2012

What is CVE-2012-5808?

The LinkPoint module in Zen Cart fails to properly validate the server hostname against the domain name specified in the Common Name (CN) or subjectAltName field of the X.509 certificate. This oversight opens the door for attackers to execute man-in-the-middle attacks by presenting a valid certificate from an arbitrary source, enabling them to spoof SSL servers and compromise secure communications.

References

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.