CVE-2012-5801: Input Validation
The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5801?
CVE-2012-5801 has a medium severity rating due to its potential for man-in-the-middle attacks.
How do I fix CVE-2012-5801?
To fix CVE-2012-5801, ensure that your PrestaShop configuration uses a strict hostname verification method for SSL certificates.
What systems are affected by CVE-2012-5801?
CVE-2012-5801 affects specific versions of the PayPal module in PrestaShop and potentially others if they do not validate SSL certificates properly.
What type of attack does CVE-2012-5801 allow?
CVE-2012-5801 allows man-in-the-middle attackers to spoof SSL servers, compromising the security of data transmitted.
Has CVE-2012-5801 been patched?
Yes, later versions of PrestaShop have addressed CVE-2012-5801, so it's important to update to the latest version.