CVE-2011-5240 (MEDIUM) CVSS 5.8
🟡 Severity: MEDIUM (CVSS 5.8)
Magento 1.5 and 1.6.2 does not verify that the server hostname matches a domain name in the subject’s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Published: 2012-11-06
Last Modified: 2026-04-29 ⚠️
References: