CVE-2012-5784

Published: Nov 4, 2012Modified: Apr 29, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected (29)

Products: Apache: Activemq, Axis · Paypal: Mass Pay, Payments Pro, Transactional Information Soap

2 products

3 products

Transactional Information Soap

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Apache Activemq	Up to 5.7.0
Apache Axis	Up to 1.4
Apache Axis	All versions
Apache Axis	All versions
Apache Axis	All versions
Apache Axis	All versions
Apache Axis	All versions
Apache Axis	All versions
Apache Axis	Version 1.0
Apache Axis	Version 1.0 beta
Apache Axis	Version 1.0 rc1
Apache Axis	Version 1.0 rc2
Apache Axis	Version 1.1
Apache Axis	Version 1.1 beta
Apache Axis	Version 1.1 rc1
Apache Axis	Version 1.1 rc2
Apache Axis	Version 1.2.1
Apache Axis	Version 1.2
Apache Axis	Version 1.2 alpha
Apache Axis	Version 1.2 beta1
Apache Axis	Version 1.2 beta2
Apache Axis	Version 1.2 beta3
Apache Axis	Version 1.2 rc1
Apache Axis	Version 1.2 rc2
Apache Axis	Version 1.2 rc3
Apache Axis	Version 1.3
Paypal Mass Pay	All versions
Paypal Payments Pro	All versions
Paypal Transactional Information Soap	All versions

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (28)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2013-0269.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0683.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-0037.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/51219

Source: cve@mitre.org

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Source: cve@mitre.org

ExploitTechnical Description

http://www.securityfocus.com/bid/56408

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/79829

Source: cve@mitre.org

https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0269.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0683.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2014-0037.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://secunia.com/advisories/51219

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical Description

http://www.securityfocus.com/bid/56408

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/79829

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.