Lack of certificate validation on calls to external services enables man-in-the-middle attacks on those calls. This resulted in possible disclosure of customer information. The risk was low due to the effort needed to execute such an attack.
Part of patch SUPEE-8788
This vulnerability affects the following application versions:
- Magento 1.4.0.0
- Magento 1.4.0.1
- Magento 1.4.1.0
- Magento 1.4.1.1
- Magento 1.4.2.0
- Magento 1.5.0.1
- Magento 1.5.1.0
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4