GitHub Advisoryadvisory · Maven

GHSA-wwq7-pxwc-p4rc Apache Axis2 has Improper Input Validation

MEDIUM Published 2022-05-17 Modified 2025-12-04 Official page ↗
Aliases
CVE-2012-5785
Ecosystem
Maven
Packages
org.apache.axis2:axis2, org.apache.axis2:axis2-transport-http
Severity
Moderate
Weaknesses
CWE-20
Reviewed
2022-07-12

Affected packages

• Maven org.apache.axis2:axis2: < 1.8.0 → fixed in 1.8.0 • Maven org.apache.axis2:axis2-transport-http: < 1.8.0 → fixed in 1.8.0

Description

Apache Axis2/Java 1.7.9 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Related

Alias · CVE (1)

  • CVE-2012-5785 Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References