CVE-2010-0744
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the...
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
Exploit likelihood
What each source reports
NVD Score used
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
- Record
CVE-2010-0744- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
- Record
CVE-2010-0744- Updated
- 2026-11-02
EUVDEUVD-2010-0770 No score
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
- Record
EUVD-2010-0770- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p9f4-9pfr-g2fp No score
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the...
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
- Record
GHSA-p9f4-9pfr-g2fp- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-0744 is a medium vulnerability (CVSS 5.8) in Alvaro Alvaros Messenger, published April 20, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.31%, the 70th percentile. No source names a fixed version.
References
lists.fedoraproject.org/pipermail/package-announce/2010-May/041046.html
amsn.svn.sourceforge.net/viewvc/amsn/trunk?view=log&pathrev=11991
openwall.com/lists/oss-security/2010/03/10/4
secunia.com/advisories/39796
Show 11 moreShow less
securityfocus.com/bid/35507
bugs.debian.org/cgi-bin/bugreport.cgi?bug=572818
seclists.org/bugtraq/2009/Jun/239
opensource-archive.org/showthread.php?p=183821
vupen.com/english/advisories/2010/1109
nvd.nist.gov/vuln/detail/CVE-2010-0744
github.com/advisories/GHSA-p9f4-9pfr-g2fp