Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2012-5789: PayPal Payments Standard PHP Library can be spoofed

CVE-2012-5789 · published 14 years ago

Summary

Versions of the PayPal Payments Standard PHP Library released before April 2012 do not confirm that an SSL certificate matches the PayPal server name. This lets attackers intercept or fake the connection and potentially steal payment data. Update the library to the latest version or replace it with a supported payment integration.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
paypal	payments_standard	All versions `cpe:2.3:a:paypal:payments_standard:-:::::::*`

Original advisory text

PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to intentional disabling of certificate-validation checks through a "FALSE" value.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published4 Nov 2012

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2012-5789 · NVD

Track software like this

Free during beta