CVE-2012-6399
Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, aka Bug ID CSCud94176.
Published
2013-05-27T14:55:01.037
Last Modified
2025-04-11T00:51:21.963
Status
Deferred
Source
[email protected]
Severity
CVSSv2: 5.8 (MEDIUM)
CVSSv2 Vector
AV:N/AC:M/Au:N/C:P/I:P/A:N
- Access Vector: NETWORK
- Access Complexity: MEDIUM
- Authentication: NONE
- Confidentiality Impact: PARTIAL
- Integrity Impact: PARTIAL
- Availability Impact: NONE
Exploitability Score
8.6
Impact Score
4.9
Weaknesses
Affected Vendors & Products
| Type |
Vendor |
Product |
Version/Range |
Vulnerable? |
| Application |
cisco
|
webex
|
4.1 |
Yes
|
References