CVE-2011-5242 tmhOAuth before 0.61 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle a...
MediumCVSS 5.8
EPSS 0.52%
- Published
- Updated
- Exploit status
- No public exploit known
Description
tmhOAuth before 0.61 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| themattharris tmhoauth | <= 0.60 | No fix listed |
| themattharris tmhoauth | = 0.2 | No fix listed |
| themattharris tmhoauth | = 0.3 | No fix listed |
| themattharris tmhoauth | = 0.4 | No fix listed |
| themattharris tmhoauth | = 0.5 | No fix listed |
| themattharris tmhoauth | = 0.11 | No fix listed |
| themattharris tmhoauth | = 0.12 | No fix listed |
| themattharris tmhoauth | = 0.13 | No fix listed |
| themattharris tmhoauth | = 0.14 | No fix listed |
| themattharris tmhoauth | = 0.51 | No fix listed |
| themattharris tmhoauth | = 0.52 | No fix listed |
| themattharris tmhoauth | = 0.53 | No fix listed |
| themattharris tmhoauth | = 0.54 | No fix listed |
| themattharris tmhoauth | = 0.55 | No fix listed |
| themattharris tmhoauth | = 0.56 | No fix listed |
| themattharris tmhoauth | = 0.57 | No fix listed |
| themattharris tmhoauth | = 0.58 | No fix listed |