CVE-2013-0289
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the...
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit likelihood
What each source reports
NVD Score used
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2013-0289- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2013-0289- Updated
- 2026-11-02
EUVDEUVD-2013-0310 No score
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
EUVD-2013-0310- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x9p3-334f-m7g8 No score
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the...
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-x9p3-334f-m7g8- Updated
- 2026-11-02
OSV No score
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2013-0289- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0289 No score
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
DEBIAN-CVE-2013-0289- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-0289 No score
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
UBUNTU-CVE-2013-0289- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-0289 is a medium vulnerability (CVSS 4.3) in Isync Project Isync, published May 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in isync 1.0.4-2.2.
References
lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html
securityfocus.com/bid/57423
exchange.xforce.ibmcloud.com/vulnerabilities/82232
openwall.com/lists/oss-security/2013/02/20/9
secunia.com/advisories/55190
sourceforge.net/projects/isync/files/isync/1.0.6
Show 8 moreShow less
security.gentoo.org/glsa/glsa-201310-02.xml
nvd.nist.gov/vuln/detail/CVE-2013-0289
github.com/advisories/GHSA-x9p3-334f-m7g8
security-tracker.debian.org/tracker/CVE-2013-0289
ubuntu.com/security/CVE-2013-0289
cve.org/CVERecord?id=CVE-2013-0289