CVE-2012-5785

Apache Axis2/Java < 1.6.2 - Man-in-the-Middle Attack via Unverified X.509 Certificate

Title source: llm
STIX 2.1

Description

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References (4)

Core 4
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/51219
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79830
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/56408

Scores

EPSS 0.0221
EPSS Percentile 80.5%

Details

CWE
CWE-20
Status published
Products (11)
apache/axis2 1.5.1
apache/axis2 1.5.2
apache/axis2 1.5.3
apache/axis2 1.5.4
apache/axis2 1.5.5
apache/axis2 1.5.6
apache/axis2 1.6
apache/axis2 1.6.1
apache/axis2 < 1.6.2
org.apache.axis2/axis2 0 - 1.8.0Maven
... and 1 more
Published Nov 04, 2012
Tracked Since Feb 18, 2026