What is the CVSS score of CVE-2013-2770?

CVE-2013-2770 has a CVSS 2.0 base score of 5.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.1%.

Kanaka CVE-2013-2770

MEDIUM

Improper Input Validation (CWE-20)

2013-04-07 cve@mitre.org

Information Disclosure Kanaka Novell

5.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Apr 07, 2013 - 17:55 cve.org

MEDIUM 5.8

DescriptionCVE.org

The installation functionality in the Novell Kanaka component before 2.8 for Novell Open Enterprise Server (OES) on Mac OS X does not verify the server's X.509 certificate during an SSL session, which allows man-in-the-middle attackers to spoof servers via an arbitrary certificate.

AnalysisAI

The installation functionality in the Novell Kanaka component before 2.8 for Novell Open Enterprise Server (OES) on Mac OS X does not verify the server's X.509 certificate during an SSL session,. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. The installation functionality in the Novell Kanaka component before 2.8 for Novell Open Enterprise Server (OES) on Mac OS X does not verify the server's X.509 certificate during an SSL session, which allows man-in-the-middle attackers to spoof servers via an arbitrary certificate. Affected products include: Novell Kanaka. Version information: before 2.8.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.