medium
5.8
CWE
20
Advisory Published
Updated

CVE-2012-5784: Input Validation

First published: Sun Nov 04 2012(Updated: )

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Apache ActiveMQ<=5.7.0
Apache Axis<=1.4
Apache Axis=alpha1
Apache Axis=alpha2
Apache Axis=alpha3
Apache Axis=beta1
Apache Axis=beta2
Apache Axis=beta3
Apache Axis=1.0
Apache Axis=1.0-beta
Apache Axis=1.0-rc1
Apache Axis=1.0-rc2
Apache Axis=1.1
Apache Axis=1.1-beta
Apache Axis=1.1-rc1
Apache Axis=1.1-rc2
Apache Axis=1.2
Apache Axis=1.2-alpha
Apache Axis=1.2-beta1
Apache Axis=1.2-beta2
Apache Axis=1.2-beta3
Apache Axis=1.2-rc1
Apache Axis=1.2-rc2
Apache Axis=1.2-rc3
Apache Axis=1.2.1
Apache Axis=1.3
PayPal Mass Pay
PayPal Payments Pro
PayPal Transactional Information SOAP
IBM Cognos Analytics<=12.0.0-12.0.1
IBM Cognos Analytics<=11.2.0-11.2.4 FP2
IBM Cognos Analytics<=11.1.1-11.1.7 FP7

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is CVE-2012-5784?

    CVE-2012-5784 is a vulnerability in Apache Axis 1.4 that allows a remote attacker to conduct spoofing attacks.

  • What is the severity of CVE-2012-5784?

    The severity of CVE-2012-5784 is medium.

  • Which software products are affected by CVE-2012-5784?

    The software products affected by CVE-2012-5784 include Apache Axis, Apache ActiveMQ, PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, and IBM Security Directory Suite VA.

  • How can I fix CVE-2012-5784?

    To fix CVE-2012-5784, upgrade to a version of Apache Axis that is not affected by the vulnerability.

  • Where can I find more information about CVE-2012-5784?

    You can find more information about CVE-2012-5784 in the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html), [Reference 3](http://rhn.redhat.com/errata/RHSA-2013-0269.html).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203