Every CVE Search/ Get API key

CVE-2012-5784

Man-in-the-middle attack in Apache Axis

5.8 MediumFix available

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Exploit likelihood

5.72%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.8

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
CVE-2012-5784
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
CVE-2012-5784
Updated
2026-11-02
EUVDEUVD-2020-1408 No score

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
EUVD-2020-1408
Updated
2026-11-03
GitHub AdvisoriesGHSA-55w9-c3g2-4rrh No score

Man-in-the-middle attack in Apache Axis

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
GHSA-55w9-c3g2-4rrh
Weakness
CWE-20
Updated
2026-11-02
OSV No score

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
CVE-2012-5784
Updated
2026-11-02
OSVDEBIAN-CVE-2012-5784 No score

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
DEBIAN-CVE-2012-5784
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-55w9-c3g2-4rrh No score

Man-in-the-middle attack in Apache Axis

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Record
GHSA-55w9-c3g2-4rrh
Weakness
CWE-20
Updated
2026-11-02
OSVMGASA-2013-0200 No score

Updated axis package fixes security vulnerability

Apache Axis did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name (CVE-2012-5784).

Record
MGASA-2013-0200
Updated
2026-11-02
OSVopenSUSE-SU-2019:1497-1 No score

Security update for axis

This update for axis fixes the following issues:

Security issue fixed:

  • CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1497-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10646-1 No score

axis-1.4-302.6 on GA media

These are all security issues fixed in the axis-1.4-302.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10646-1
Updated
2026-11-02
OSVSUSE-SU-2019:1373-1 No score

Security update for axis

This update for axis fixes the following issues:

Security issue fixed:

  • CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).
Record
SUSE-SU-2019:1373-1
Updated
2026-11-02
OSVSUSE-SU-2019:1373-2 No score

Security update for axis

This update for axis fixes the following issues:

Security issue fixed:

  • CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).
Record
SUSE-SU-2019:1373-2
Updated
2026-11-02
OSVSUSE-SU-2019:1382-1 No score

Security update for axis

This update for axis fixes the following issues:

Security issue fixed:

  • CVE-2012-5784, CVE-2014-3596: Fixed missing connection hostname check against X.509 certificate name (bsc#1134598).
Record
SUSE-SU-2019:1382-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.axis:axis
Maven
 through 1.4 None known
axis:axis
Maven
 through 1.4 None known
axis
Debian:12
 before 1.4-16.1
1.4-16.1
axis
Debian:13
 before 1.4-16.1
1.4-16.1
axis
Debian:14
 before 1.4-16.1
1.4-16.1
axis
Debian:6.0
 before 1.4-12+deb6u1, plus listed versions
1.4-12
1.4-12+deb6u1
axis:axis
Maven
 through 1.4, plus listed versions
1.01.11.1-beta1.21.2-RC1
Show 7 moreShow less
1.2-RC21.2-RC31.2-alpha-11.2-beta-21.2-beta-31.2.11.3
 None known
axis
Mageia:2
 before 1.4-6.1.mga2
1.4-6.1.mga2
axis
Red Hat:enterprise_linux:6::client
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-javadoc
Red Hat:enterprise_linux:6::client
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
Show 23 moreShow less
Affected packages
PackageAffectedFixed
axis-manual
Red Hat:enterprise_linux:6::client
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-javadoc
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-manual
Red Hat:enterprise_linux:6::computenode
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis
Red Hat:enterprise_linux:6::server
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-javadoc
Red Hat:enterprise_linux:6::server
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-manual
Red Hat:enterprise_linux:6::server
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-javadoc
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis-manual
Red Hat:enterprise_linux:6::workstation
 before 0:1.2.1-7.3.el6_3
0:1.2.1-7.3.el6_3
axis
Red Hat:enterprise_linux:5::server
 before 0:1.2.1-2jpp.7.el5_9
0:1.2.1-2jpp.7.el5_9
axis-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:1.2.1-2jpp.7.el5_9
0:1.2.1-2jpp.7.el5_9
axis-javadoc
Red Hat:enterprise_linux:5::server
 before 0:1.2.1-2jpp.7.el5_9
0:1.2.1-2jpp.7.el5_9
axis-manual
Red Hat:enterprise_linux:5::server
 before 0:1.2.1-2jpp.7.el5_9
0:1.2.1-2jpp.7.el5_9
jasperreports-server-pro
Red Hat:rhev_manager:3
 before 0:5.5.0-4.el6ev
0:5.5.0-4.el6ev
devtoolset-2-axis
Red Hat:developer_toolset:2.1::el6
 before 0:1.4-23.el6
0:1.4-23.el6
axis
SUSE:Linux Enterprise Module for Basesystem 15
 before 1.4-5.8.1
1.4-5.8.1
axis
SUSE:Linux Enterprise Module for Basesystem 15 SP1
 before 1.4-5.8.1
1.4-5.8.1
axis
SUSE:Linux Enterprise Server 12 SP3
 before 1.4-290.6.1
1.4-290.6.1
axis
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 1.4-290.6.1
1.4-290.6.1
axis
SUSE:Linux Enterprise Server 12 SP4
 before 1.4-290.6.1
1.4-290.6.1
axis
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 1.4-290.6.1
1.4-290.6.1
axis
openSUSE:Leap 15.0
 before 1.4-lp150.9.1
1.4-lp150.9.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-5784 is a medium vulnerability (CVSS 5.8) in Apache Activemq, published November 4, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.72%, the 93rd percentile. Fixed in axis 1.4-16.1.

References

Show 48 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open