VulnerabilityModified
CVE-2013-7304
Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session…
MEDIUM 4.3EPSS 0.60%
Does this matter?
Lower severity and a low EPSS score (0.60%). Track it; it rarely justifies an emergency change on its own.
Description
Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 0.60% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- checkpoint/endpoint security mi server r73
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/56744
- http://www.securityfocus.com/bid/65135
- http://www.securitytracker.com/id/1029704
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90674
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97784Patch, Vendor Advisory
- http://secunia.com/advisories/56744
- http://www.securityfocus.com/bid/65135
- http://www.securitytracker.com/id/1029704
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90674
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97784Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.