CVE-2012-5780

Amazon Merchant SDK - Man-in-the-Middle Attack via Improper Certificate Validation

Title source: llm

Description

The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (2)

Core 2

Core References

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51196

Exploit x_refsource_misc

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Scores

EPSS 0.0013

EPSS Percentile 32.8%

Details

CWE

CWE-20

Status published

Products (1)

amazon/merchant_sdk

Published Nov 04, 2012

Tracked Since Feb 18, 2026