What is the CVSS score of CVE-2012-5524?

CVE-2012-5524 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2012-5524?

Yes, a public proof-of-concept exploit is available for CVE-2012-5524. Prioritise patching immediately. EPSS: 0.2%.

Gajim CVE-2012-5524

MEDIUM

Improper Input Validation (CWE-20)

2014-02-08 secalert@redhat.com

Information Disclosure Gajim

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Feb 08, 2014 - 00:55 cve.org

MEDIUM 4.3

DescriptionCVE.org

The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.

AnalysisAI

The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA. Affected products include: Gajim. Version information: before 0.15.3.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.