CVE-2011-1094

CVE-2011-1094 describes a vulnerability in KDE KSSL within kdelibs versions prior to 4.6.1, specifically in the kio/kio/tcpslavebase.cpp component. This flaw allows man-in-the-middle attackers to spoof arbitrary SSL servers. The vulnerability arises because the software fails to properly verify that the server hostname matches the domain name in an X.509 certificate, enabling attackers to use certificates issued for an IP address by a legitimate Certificate Authority. The vulnerability has a CVSS score of 4.3 (Medium severity), indicating a network-based attack with medium complexity and a potential impact of partial integrity compromise, but no confidentiality or availability impact. Its EPSS score is very low, suggesting a low likelihood of exploitation. There is no evidence of active exploitation, nor are there known Metasploit modules, Nuclei templates, or ExploitDB entries. Community discussion and media coverage for this CVE are also non-existent, further indicating a lack of widespread attention or exploitation.