CVE-2012-6107
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's...
CVE-2012-6107 is a medium vulnerability (CVSS 4.3) in Apache Axis2\/c, published September 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. No source names a fixed version.
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploit likelihood
What each source reports
NVD Score used
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2012-6107- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
CVE-2012-6107- Updated
- 2026-11-02
EUVDEUVD-2012-5976 No score
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
EUVD-2012-5976- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qjfc-9x3x-5h2r No score
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's...
Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
- Record
GHSA-qjfc-9x3x-5h2r- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD |
References
issues.apache.org/jira/browse/AXIS2C-1619
mail-archives.apache.org/mod_mbox/axis-c-dev/201301.mbox/browser
securityfocus.com/bid/57267
bugzilla.redhat.com/show_bug.cgi?id=894372
exchange.xforce.ibmcloud.com/vulnerabilities/81211
lists.apache.org/thread.html/0e30b2b72099a995f6e91342b03d3e4b477677d0ea77e3ce55b53614%40%3Cc-dev.axis.apache.org%3E
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-6107
github.com/advisories/GHSA-qjfc-9x3x-5h2r