What is the CVSS score of CVE-2014-0350?

CVE-2014-0350 has a CVSS 2.0 base score of 6.4 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.2%.

Poco C Libraries CVE-2014-0350

MEDIUM

Cryptographic Issues (CWE-310)

2014-04-26 cret@cert.org

Information Disclosure Poco C Libraries

6.4

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Apr 26, 2014 - 01:55 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.

AnalysisAI

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate. Affected products include: Pocoproject Poco C\+\+ Libraries. Version information: before 1.4.6.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.