CVE-2012-5811 The Breezy application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-i...

MediumCVSS 5.8 EPSS 0.57%

Published: 2012-11-05 00:00
Updated: 2026-06-17 02:47
Exploit status: No public exploit known

Description

The Breezy application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected products

Product	Affected versions	Fixed in
breezy	All versions	No fix listed

References

www.cs.utexas.edu exploit

CVSS v2.0

5.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:N

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.57% (percentile 47.5)
CWE: CWE-310

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.