CVE-2014-1263 describes a vulnerability in curl and libcurl versions 7.27.0 through 7.35.0, specifically when utilizing the SecureTransport/Darwinssl backend in Apple OS X 10.9.x prior to 10.9.2. The flaw allows man-in-the-middle attackers to spoof servers by presenting any valid X.509 certificate when a numerical IP address is used for a URL, as the hostname verification against the certificate's Common Name or subjectAltName fails. This vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity and potential for partial confidentiality impact. While it could lead to information disclosure, it does not directly impact integrity or availability. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness and attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 10.9.1CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | ||
10.9CPE matchmatch criteria | cpe:2.3:o:apple:mac_os_x:10.9:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:N/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.