CVE-2010-4211

EPSS 0.09%
Veröffentlicht 09.11.2010 01:00:02
Zuletzt bearbeitet 11.04.2025 00:51:21
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ebay ≫ Paypal Version <= 3.0

   Apple ≫ iPhone OS Version3.1
   Apple ≫ iPhone OS Version3.1.2
   Apple ≫ iPhone OS Version3.1.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.09%	0.218

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	2.9	5.5	2.9	AV:A/AC:M/Au:N/C:P/I:N/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://itunes.apple.com/us/app/paypal/id283646709

http://news.cnet.com/8301-27080_3-20021730-245.html

http://online.wsj.com/article/SB10001424052748703506904575592782874885808.html

http://viaforensics.com/press-releases/viaforensics-uncovers-paypal-application-vulnerability.html

http://viaforensics.com/security/viaforensics-uncovers-significant-vulnerability-paypal-iphone.html

http://www.securityfocus.com/bid/44657

http://www.vupen.com/english/advisories/2010/2887

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/63002

https://nvd.nist.gov/vuln/detail/CVE-2010-4211

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2010-4211

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2010-4211

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2010-4211