Vulnerability in Microsoft Outlook.com
CVE-2014-5239
The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.029 (85.4th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Outlook.com — versions 7.8.2.10.47.7365, 7.8.2.11.48.4848, 7.8.2.12.49.0430
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_JVN, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_JVNDB, Vendor Advisory, third-party-advisory)