CVE-2010-4252
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters...
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
Exploit likelihood
What each source reports
NVD Score used
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
- Record
CVE-2010-4252- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
- Record
CVE-2010-4252- Updated
- 2026-11-02
EUVDEUVD-2010-4225 No score
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
- Record
EUVD-2010-4225- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4wx9-m243-hr54 No score
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters...
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
- Record
GHSA-4wx9-m243-hr54- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-4252 is a high vulnerability (CVSS 7.5) in Openssl, published December 6, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.30%, the 94th percentile. No source names a fixed version.
References
www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19039
vupen.com/english/advisories/2010/3120
cvs.openssl.org/chngview?cn=20098
Show 13 moreShow less
secunia.com/advisories/42469
marc.info?l=bugtraq&m=130497251507577&w=2
securityfocus.com/bid/45163
securitytracker.com/id?1024823
openssl.org/news/secadv_20101202.txt
github.com/seb-m/jpake
bugzilla.redhat.com/show_bug.cgi?id=659297
seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf
nvd.nist.gov/vuln/detail/CVE-2010-4252
access.redhat.com/security/cve/CVE-2010-4252