CVE-2012-5662

Published: May 27, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected (19)

Products: Paul Mattes: X3270

Paul Mattes

1 product

X3270

Configuration A

19 vulnerable

Vulnerable Software	Affected Versions
Paul Mattes X3270	version ≤ 3.3.12
Paul Mattes X3270	Version 3.3.10 ga3
Paul Mattes X3270	Version 3.3.10 ga4
Paul Mattes X3270	Version 3.3.10 ga5
Paul Mattes X3270	Version 3.3.11 beta2
Paul Mattes X3270	Version 3.3.11 beta4
Paul Mattes X3270	Version 3.3.11 ga6
Paul Mattes X3270	Version 3.3.12 beta6
Paul Mattes X3270	Version 3.3.12 ga10
Paul Mattes X3270	Version 3.3.12 ga7
Paul Mattes X3270	Version 3.3.5
Paul Mattes X3270	Version 3.3.6
Paul Mattes X3270	Version 3.3.7
Paul Mattes X3270	Version 3.3.8
Paul Mattes X3270	Version 3.3.8 p1
Paul Mattes X3270	Version 3.3.8 p2
Paul Mattes X3270	Version 3.3.8 p3
Paul Mattes X3270	Version 3.3.9 ga11
Paul Mattes X3270	Version 3.3.9 ga12