CVE-2012-5810 describes a critical vulnerability in the Chase mobile banking application for Android, where the app failed to properly validate server hostnames against X.509 certificates. This oversight, categorized as CWE-295, allowed man-in-the-middle (MITM) attackers to spoof SSL servers using any valid certificate, affecting the jpmorganchase chase_mobile product. The vulnerability carries a CVSS v3.1 score of 5.9 (Medium), indicating a network-based attack with high complexity (AC:H) but significant potential for integrity impact (I:H) without user interaction. Attackers could intercept and potentially manipulate sensitive banking data due to the lack of hostname verification. Despite its severity, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention, likely due to the fix being implemented in the summer of 2012.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:jpmorganchase:chase_mobile:-:-:*:*:*:android:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.