CVE-2012-5785
Apache Axis2 has Improper Input Validation
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit likelihood
What each source reports
NVD Score used
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2012-5785- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2012-5785- Updated
- 2026-11-02
EUVDEUVD-2022-5659 No score
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
EUVD-2022-5659- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wwq7-pxwc-p4rc No score
Apache Axis2 has Improper Input Validation
Apache Axis2/Java 1.7.9 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-wwq7-pxwc-p4rc- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-wwq7-pxwc-p4rc No score
Apache Axis2 has Improper Input Validation
Apache Axis2/Java 1.7.9 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-wwq7-pxwc-p4rc- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.axis2:axis2Maven |
before 1.8.0 | 1.8.0 |
org.apache.axis2:axis2-transport-httpMaven |
before 1.8.0 | 1.8.0 |
org.apache.axis2:axis2Maven |
before 1.8.0, plus listed versions 1.11.1.11.21.31.4 Show 23 moreShow less1.4.11.51.5.11.5.21.5.31.5.41.5.51.5.61.6.01.6.11.6.21.6.31.6.41.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.9 |
1.8.0 |
org.apache.axis2:axis2-transport-httpMaven |
before 1.8.0, plus listed versions 1.51.5.11.5.21.5.31.5.4 Show 17 moreShow less1.5.51.5.61.6.01.6.11.6.21.6.31.6.41.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.81.7.9 |
1.8.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-5785 is a medium vulnerability (CVSS 5.8) in Apache Axis2, published November 4, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.23%, the 82nd percentile. Fixed in org.apache.axis2:axis2 1.8.0.