CVE-2012-5822

7.4 highEPSS 0.6%

High (7.4) in mozilla zamboni. EPSS 0.6% chance of exploitation in the next 30 days.

The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python urllib2 library.

Severity

CVSS 3.1

7.4 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2012-11-04
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mozilla:zamboni

References

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79929
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79929

Check your stack JSON