725
Reference Description
https://www.cve.org/CVERecord?id=CVE-2012-5819
CVE-2012-5817 Java library uses JSSE SSLSocket and SSLEngine classes, which do not
verify the hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5817
CVE-2012-5784 SOAP platform does not verify the hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5784
CVE-2012-5782 PHP library for payments does not verify the hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5782
CVE-2012-5780 Merchant SDK for payments does not verify the hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5780
CVE-2003-0355 Web browser does not validate Common Name, allowing spoofing of https
sites.
https://www.cve.org/CVERecord?id=CVE-2003-0355
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 948 SFP Secondary Cluster: Digital Certificate 888 2395
MemberOf 1353 OWASP Top Ten 2021 Category A07:2021 -
Identification and Authentication Failures
1344 2494
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Failure to validate host-specific
certificate data
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-245]Martin Georgiev, Subodh Iyengar, Suman Jana, Rishita Anubhai, Dan Boneh and Vitaly
Shmatikov. "The Most Dangerous Code in the World: Validating SSL Certificates in Non-Browser
Software". 2012 October 5. < http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf >.
[REF-243]Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith and Lars Baumgärtner,
Bernd Freisleben. "Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security".
2012 October 6. < http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdf >.
[REF-249]Kenneth Ballard. "Secure programming with the OpenSSL API, Part 2:
Secure handshake". 2005 May 3. < https://developer.ibm.com/tutorials/l-openssl/?
mhsrc=ibmsearch_a&mhq=secure%20programming%20with%20the%20openssl%20API
>.2023-04-07.
[REF-250]Eric Rescorla. "An Introduction to OpenSSL Programming (Part I)". 2001 October 5. <
https://www.linuxjournal.com/article/4822 >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-955]Chris McMahon Stone, Tom Chothia and Flavio D. Garcia. "Spinner: Semi-Automatic
Detection of Pinning without Hostname Verification". < http://www.cs.bham.ac.uk/~garciaf/
publications/spinner.pdf >.2018-01-16.
CWE Version 4.14
CWE-298: Improper Validation of Certificate Expiration
CWE-298: Improper Validation of Certificate Expiration