CVE-2012-5784: Input Validation
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Other sources
Apache Axis 1.4, as used in multiple products, could allow a remote attacker to conduct spoofing attacks, caused by the failure to verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate. An attacker could exploit this vulnerability using man-in-the-middle techniques to spoof an SSL server and launch further attacks against a vulnerable target.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is CVE-2012-5784?
CVE-2012-5784 is a vulnerability in Apache Axis 1.4 that allows a remote attacker to conduct spoofing attacks.
What is the severity of CVE-2012-5784?
The severity of CVE-2012-5784 is medium.
Which software products are affected by CVE-2012-5784?
The software products affected by CVE-2012-5784 include Apache Axis, Apache ActiveMQ, PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, and IBM Security Directory Suite VA.
How can I fix CVE-2012-5784?
To fix CVE-2012-5784, upgrade to a version of Apache Axis that is not affected by the vulnerability.
Where can I find more information about CVE-2012-5784?
You can find more information about CVE-2012-5784 in the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html), [Reference 3](http://rhn.redhat.com/errata/RHSA-2013-0269.html).