CVE-2011-5240

CVE-2011-5240 describes a vulnerability in Magento 1.5 and 1.6.2 where the software fails to properly validate SSL certificates, specifically by not verifying that the server hostname matches the domain name in the certificate. This oversight enables man-in-the-middle attacks, allowing attackers to spoof SSL servers using any valid certificate. The vulnerability has a CVSS score of 5.8, indicating a medium severity with a network attack vector and medium attack complexity, potentially leading to partial confidentiality and integrity compromise. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.