CVE-2014-5867

CVE-2014-5867 describes a critical vulnerability in the Capital One Spark Pay Android application (version 0.9.81) where the app fails to properly validate X.509 certificates from SSL servers. This flaw allows an attacker to perform a man-in-the-middle attack, spoofing legitimate servers to intercept sensitive information through a crafted certificate. The vulnerability has a CVSS score of 5.4, indicating a medium severity, and could lead to partial compromise of confidentiality, integrity, and availability if exploited over an adjacent network with medium attack complexity. There is no evidence of active exploitation, nor are there known public exploits or Metasploit modules available, and it has received minimal community discussion or media coverage.