CVE-2012-5802: The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject...

Security readout for executives and security teams

The PayPal module in Ubercart failed to confirm that an SSL certificate belonged to the server it contacted. In the right network position, an attacker could impersonate the payment endpoint using another valid certificate. The bundle does not identify affected versions or a vendor patch. Likely exposure is limited to Drupal/Ubercart ecommerce deployments using the PayPal module. The provided sources do not name specific affected versions, package names, or supported release branches. Prioritize if the organization still runs legacy Ubercart payment flows. Payment interception risk is business-sensitive, but urgency depends on whether the module is present and whether current vendor guidance identifies a vulnerable version. Mitigation focus: Check Ubercart and Drupal security advisories for affected versions and fixes.; Update or replace the PayPal module according to vendor guidance.; Verify outbound TLS validation enforces hostname checks against CN or subjectAltName..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.