CVE-2012-5820

{"id": "CVE-2012-5820", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-11-04T22:55:04.780", "references": [{"url": "http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/79931", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The developer-account sample code in Google AdMob does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."}, {"lang": "es", "value": "El c\u00f3digo de ejemplo de la cuenta de desarrollador de Google AdMob no comprueba si el nombre del servidor coincide con un nombre de dominio en el nombre com\u00fan (CN) del sujeto o el campo subjectAltName del certificado X.509, lo que permite ataques man-in-the-middle que falsifican servidores SSL mediante un certificado v\u00e1lido de su elecci\u00f3n."}], "lastModified": "2017-08-29T01:32:47.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:google:admob:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C7054F4-8773-49ED-B2B3-6B3C711B3353"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}