What is CVE-2012-2993?

CVE-2012-2993 is a medium-severity vulnerability in Microsoft Windows Phone 7, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2012-09-18.

How severe is CVE-2012-2993?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Microsoft Windows Phone 7

CVE-2012-2993

Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.

Vulnerability class: Improper Certificate Validation

EPSS: 0.036 (88.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-295 — Improper Certificate Validation

References

cret@cert.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
cret@cert.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
cret@cert.org (x_refsource_OSVDB, vdb-entry, Broken Link)
cret@cert.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)

Frequently asked questions

What is CVE-2012-2993?: CVE-2012-2993 is a medium-severity vulnerability in Microsoft Windows Phone 7, classified under Improper Certificate Validation. CVSS score: 5.9/10. Published 2012-09-18.
How severe is CVE-2012-2993?: Medium severity. CVSS v3 base score is 5.9 out of 10.