CVE-2012-5817

Published: Nov 4, 2012Modified: Apr 29, 2026

7.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.2 / Impact: 5.2

Source: NVD

Description

Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected (2)

Products: Amazon: Ec2 Api Tools Java Library · Codehaus: Xfire

1 product

Ec2 Api Tools Java Library

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Amazon Ec2 Api Tools Java Library	All versions
Codehaus Xfire	Up to 1.2.6

Related CWEs

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (4)

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Source: cve@mitre.org

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/79934

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

https://exchange.xforce.ibmcloud.com/vulnerabilities/79934

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.