CVE-2012-5785 Apache Axis2 has Improper Input Validation
MediumCVSS 5.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.axis2/axis2(Maven) | < 1.8.0 | 1.8.0 |
| org.apache.axis2/axis2(Maven) | = 1.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.1.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.4.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.5 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.5.6 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.0 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.6.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.0 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.1 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.2 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.3 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.4 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.5 | No fix listed |
Show 36 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.axis2/axis2(Maven) | = 1.7.6 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.7 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.8 | No fix listed |
| org.apache.axis2/axis2(Maven) | = 1.7.9 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | < 1.8.0 | 1.8.0 |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5.1 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5.2 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5.3 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5.4 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5.5 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.5.6 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.6.0 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.6.1 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.6.2 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.6.3 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.6.4 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.0 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.1 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.2 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.3 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.4 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.5 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.6 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.7 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.8 | No fix listed |
| org.apache.axis2/axis2-transport-http(Maven) | = 1.7.9 | No fix listed |
| apache axis2 | <= 1.6.2 | No fix listed |
| apache axis2 | = 1.5.1 | No fix listed |
| apache axis2 | = 1.5.2 | No fix listed |
| apache axis2 | = 1.5.3 | No fix listed |
| apache axis2 | = 1.5.4 | No fix listed |
| apache axis2 | = 1.5.5 | No fix listed |
| apache axis2 | = 1.5.6 | No fix listed |
| apache axis2 | = 1.6 | No fix listed |
| apache axis2 | = 1.6.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- apache-axis2-ssl-spoofing(79830) vdb-entry
- github.com product
- issues.apache.org
- www.cs.utexas.edu exploit
- 51219 third-party-advisory
- 56408 vdb-entry
- github.com