CVE-2012-5817

HighCVSS 7.4/10Last modified Jun 16, 2026

Description

Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2012
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-58185.8ElephantDrive does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of thCVE-2012-58197.4FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of thCVE-2012-58205.8The developer-account sample code in Google AdMob does not verify that the server hostname matches a domain name in the subject's Common NamCVE-2012-58215.9Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers CVE-2012-58227.4The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjCVE-2012-58235.8Open Source Classifieds does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fCVE-2012-58245.8Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field oCVE-2012-58257.4Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509CVE-2012-58274.3Joomla! 2.5.x before 2.5.8 and 3.0.x before 3.0.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors involving CVE-2012-58286.5BlackBerry PlayBook before 2.1 has an Information Disclosure Vulnerability via a Web browser component errorCVE-2012-58299.3Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, ThunderbCVE-2012-58308.8Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x