CVE-2012-5784

Опубликовано: 04 нояб. 2012

Источник: nvd

CVSS2: 5.8

EPSS Низкий

Описание

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*

Версия до 5.7.0 (включая)

cpe:2.3:a:apache:axis:*:*:*:*:*:*:*:*

Версия до 1.4 (включая)

cpe:2.3:a:apache:axis:-:alpha1:*:*:*:*:*:*

cpe:2.3:a:apache:axis:-:alpha2:*:*:*:*:*:*

cpe:2.3:a:apache:axis:-:alpha3:*:*:*:*:*:*

cpe:2.3:a:apache:axis:-:beta1:*:*:*:*:*:*

cpe:2.3:a:apache:axis:-:beta2:*:*:*:*:*:*

cpe:2.3:a:apache:axis:-:beta3:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.0:*:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.0:beta:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.0:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.0:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.1:beta:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.1:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.1:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:*:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:alpha:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:beta1:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:beta2:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:beta3:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:rc1:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:rc2:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2:rc3:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:apache:axis:1.3:*:*:*:*:*:*:*

cpe:2.3:a:paypal:mass_pay:-:*:*:*:*:*:*:*

cpe:2.3:a:paypal:payments_pro:-:*:*:*:*:*:*:*

cpe:2.3:a:paypal:transactional_information_soap:-:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.01566

Низкий

5.8 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2012-5784

ubuntu

около 13 лет назад

CVE-2012-5784

redhat

около 13 лет назад

CVE-2012-5784

debian

около 13 лет назад

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Ma ...

GHSA-55w9-c3g2-4rrh

github

около 5 лет назад

Man-in-the-middle attack in Apache Axis

ELSA-2013-0683

oracle-oval

больше 12 лет назад

ELSA-2013-0683: axis security update (MODERATE)

EPSS

Процентиль: 81%

0.01566

Низкий

5.8 Medium

CVSS2

Дефекты

CWE-20