CVE-2010-4211: Low severity eBay Paypal vulnerability
Published Nov 8, 2010
·Updated
The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.
Affected Software
4 affected components
eBay Paypal<=3.0
Apple iPhone OS=3.1
Apple iPhone OS=3.1.2
Apple iPhone OS=3.1.3
Event History
Nov 8, 2010
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Nov 9, 2010
Data Sourced
01:00 AM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-4211?
CVE-2010-4211 is classified as a low to medium severity vulnerability due to the potential for man-in-the-middle attacks.
2
How do I fix CVE-2010-4211?
To fix CVE-2010-4211, update the PayPal app to version 3.0.1 or later for proper certificate validation.
3
Which versions of the PayPal app are affected by CVE-2010-4211?
CVE-2010-4211 affects PayPal app versions prior to 3.0.1.
4
What type of attack does CVE-2010-4211 enable?
CVE-2010-4211 enables man-in-the-middle attacks by allowing an arbitrary certificate to spoof the PayPal web server.
5
Which devices are affected by CVE-2010-4211?
CVE-2010-4211 affects the PayPal app on iOS devices running versions before 3.0.1.