CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

• CWE-20

• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html
• http://rhn.redhat.com/errata/RHSA-2013-0269.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0683.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0037.htmlThird Party Advisory
• http://secunia.com/advisories/51219
• http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfExploit, Technical Description
• http://www.securityfocus.com/bid/56408Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79829
• https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html
• http://rhn.redhat.com/errata/RHSA-2013-0269.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0683.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0037.htmlThird Party Advisory
• http://secunia.com/advisories/51219
• http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfExploit, Technical Description
• http://www.securityfocus.com/bid/56408Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79829
• https://lists.apache.org/thread.html/44d4e88a5fa8ae60deb752029afe9054da87c5f859caf296fcf585e5%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/5e6c92145deddcecf70c3604041dcbd615efa2d37632fc2b9c367780%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/8aa25c99eeb0693fc229ec87d1423b5ed5d58558618706d8aba1d832%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/a308887782e05da7cf692e4851ae2bd429a038570cbf594e6631cc8d%40%3Cjava-dev.axis.apache.org%3E
• https://lists.apache.org/thread.html/de2af12dcaba653d02b03235327ca4aa930401813a3cced8e151d29c%40%3Cjava-dev.axis.apache.org%3E

Published

Nov 4, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-5776Dokeos 2.1.1 has multiple XSS issues involving "extra_" para…5.4
• CVE-2012-5777Eval injection vulnerability in the ReplaceListVars function…
• CVE-2012-5780The Amazon merchant SDK does not verify that the server host…
• CVE-2012-5781Amazon Elastic Load Balancing API Tools does not verify that…
• CVE-2012-5782Amazon Flexible Payments Service (FPS) PHP Library does not …
• CVE-2012-5783Apache Commons HttpClient 3.x, as used in Amazon Flexible Pa…
• CVE-2012-5785Apache Axis2/Java 1.6.2 and earlier does not verify that the…
• CVE-2012-5786The wsdl_first_https sample code in distribution/src/main/re…
• CVE-2012-5787The PayPal merchant SDK does not verify that the server host…
• CVE-2012-5788The PayPal IPN utility does not verify that the server hostn…
• CVE-2012-5789PayPal Payments Standard PHP Library before 20120427 does no…
• CVE-2012-5790PayPal Payments Standard PHP Library 20120427 does not verif…