CVE-2012-5784

Apache Axis <= 1.4 - Man-in-the-Middle Attack via SSL Certificate Hostname Mismatch

Title source: llm

Description

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (14)

Core 14

Core References

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0269.html

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0037.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/51219

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0683.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/56408

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/79829

Exploit, Technical Description x_refsource_misc

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E

Scores

EPSS 0.0572

EPSS Percentile 92.2%

Details

CWE

CWE-20

Status published

Products (13)

apache/activemq < 5.7.0

apache/axis (6 CPE variants)

apache/axis 1.0 (4 CPE variants)

apache/axis 1.1 (4 CPE variants)

apache/axis 1.2 (8 CPE variants)

apache/axis 1.2.1

apache/axis 1.3

apache/axis < 1.4

axis/axis 0Maven

org.apache.axis/axis 0Maven

... and 3 more

Published Nov 04, 2012

Tracked Since Feb 18, 2026