{"containers": {"cna": {"affected": [{"product": "RHEV-M VDC", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.2.0"}]}], "datePublic": "2009-10-14T00:00:00", "descriptions": [{"lang": "en", "value": "In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform."}], "problemTypes": [{"descriptions": [{"description": "Other", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-11-09T02:32:02", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3552"}, {"tags": ["x_refsource_MISC"], "url": "https://access.redhat.com/security/cve/cve-2009-3552"}, {"name": "42639", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "https://www.securityfocus.com/bid/42639"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:31:10.393Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3552"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://access.redhat.com/security/cve/cve-2009-3552"}, {"name": "42639", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "https://www.securityfocus.com/bid/42639"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2009-3552", "datePublished": "2019-11-09T02:32:02", "dateReserved": "2009-10-05T00:00:00", "dateUpdated": "2024-08-07T06:31:10.393Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_virtualization_manager:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "BD61E07C-8CE1-4EC5-88FD-5410CB42D944", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform."}, {"lang": "es", "value": "En RHEV-M VDC versi\u00f3n 2.2.0, se detect\u00f3 que el certificado SSL no fue comprobado cuando se usaba la interfaz Red Hat Enterprise Virtualization Manager del lado del cliente (una aplicaci\u00f3n de navegador XAML de Windows Presentation Foundation (WPF)) para conectar con el Red Hat Enterprise Virtualization Manager. Un atacante en la red local podr\u00eda utilizar este fallo para conducir un ataque de tipo man-in-the-middle, enga\u00f1ando al usuario para que piense que est\u00e1 visualizando el Red Hat Enterprise Virtualization Manager cuando el contenido est\u00e1 realmente controlado por el atacante, o modificando acciones que un usuario solicit\u00f3 a Red Hat Enterprise Virtualization Manager realizar."}], "id": "CVE-2009-3552", "lastModified": "2019-11-12T21:56:26.007", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.9, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 5.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-11-09T03:15:10.307", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/cve-2009-3552"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3552"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://www.securityfocus.com/bid/42639"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2010:0613", "cpe": "cpe:/a:redhat:enterprise_linux:5::hypervisor", "product_name": "RHEV Agents (VDSM)", "release_date": "2010-08-19T00:00:00Z"}], "bugzilla": {"description": "GUI: Man in the middle attack possible on the GUI to Backend SSL connection", "id": "528890", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=528890"}, "csaw": false, "cvss": {"cvss_base_score": "3.3", "cvss_scoring_vector": "AV:A/AC:L/Au:N/C:N/I:P/A:N", "status": "verified"}, "details": ["In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform."], "name": "CVE-2009-3552", "public_date": "2010-08-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-3552\nhttps://nvd.nist.gov/vuln/detail/CVE-2009-3552"], "threat_severity": "Moderate"}