CVE-2012-5785 Apache Axis2 has Improper Input Validation

What is CVE-2012-5785?

CVE-2012-5785 is a medium-severity vulnerability in n/a, published on 4 Nov 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Weakness: CWE-20

Which versions are affected by CVE-2012-5785?

4 open source packages ship an affected version, including org.apache.axis2:axis2 and org.apache.axis2:axis2-transport-http. It affects 1 product.

Products include Apache Axis2.

How do I fix CVE-2012-5785?

Upgrade org.apache.axis2:axis2 to 1.8.0 or later.

Is CVE-2012-5785 being exploited?

There is no known exploitation of CVE-2012-5785 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2010-0219 Hardcoded credentials in n/a Critical 10.0
• CVE-2010-1632 Improper Input Validation in Apache Axis2 High 7.5
• CVE-2012-5351 Improper Authentication in Apache Axis2 Medium 6.4
• CVE-2012-4418 Apache Axis2 Vulnerable to XML Signature wrapping attack Medium 5.8
• CVE-2010-2103 Improper Neutralization of Input During Web Page Generation in Apache Axis2 Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wwq7-pxwc-p4rc.