CVE-2012-5786

Name: CVE-2012-5786
Creator: NVD / NIST
Published: 2012-11-04T22:55:03.45+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.08%

Last modified Jun 16, 2026

CVE-2012-5786 is a vulnerability of currently unknown severity. The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check. EPSS estimates a 1.08% chance of exploitation in the next 30 days.

Description

The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check

Metrics

EPSS Probability

1.08%

60.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions
Apache	Cxf	<= 2.6.17

References

http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfTechnical Description, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/79983
http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdfTechnical Description, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/79983

Timeline

Published: Nov 4, 2012
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2012-5786?

How severe is CVE-2012-5786?

Severity scoring for CVE-2012-5786 is pending analysis. The EPSS model estimates a 1.08% probability of exploitation in the next 30 days.

How do I fix CVE-2012-5786?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-5786?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST