Skip to content

Product

org.apache.axis2/axis2 vulnerabilities

3 published CVES affecting org.apache.axis2/axis2, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
0
Medium
3
Low
0
Unscored
0
CISA KEV
0

Latest org.apache.axis2/axis2 CVEs

Newest publication first

  1. CVE-2012-5785 Apache Axis2 has Improper Input Validation

    Published
    MediumCVSS 5.8

    Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

  3. CVE-2012-5351 Improper Authentication in Apache Axis2

    Published
    MediumCVSS 6.4 EPSS 5.1%

    Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.