CVE Feed

    Dashboard / CVE / CVE-2012-5783

    CVE-2012-5783

    Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

    Published:Oct 16, 2012
    Last Modified:Apr 11, 2025
    EPS:Nov 4, 2012
    EPSS Score:0.00649
    CVSS Score:3.7

    Affected Products

    Vendor
    Apache
    Product
    Httpclient
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Amq
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Brms Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Soa Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Web Framework
    Vendor
    Redhat
    Product
    Jboss Enterprise Web Platform
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Operations Network
    Vendor
    Redhat
    Product
    Rhev Manager

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-295 Improper Certificate Validation

    Related CVEs

    CVE-2026-71290 (CVSS 9.1) — Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerific…
    CVE-2026-64607 (CVSS 5.3) — HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con…
    CVE-2026-40542 (CVSS 7.3) — Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to acc…
    CVE-2025-27820 (CVSS 7.5) — A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management a…
    CVE-2020-13956 (CVSS 5.3) — Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in…
    CVE-2013-4366 (CVSS 9.8) — http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509Hostn…
    CVE-2015-5262 (CVSS 4.3) — http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the htt…
    CVE-2014-3577 (CVSS 5.8) — org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient…
    CVE-2011-1498 (CVSS 4.3) — Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, se…

    References

    http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html
    http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html
    http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html
    http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html
    http://rhn.redhat.com/errata/RHSA-2013-0270.html
    http://rhn.redhat.com/errata/RHSA-2013-0679.html
    http://rhn.redhat.com/errata/RHSA-2013-0680.html
    http://rhn.redhat.com/errata/RHSA-2013-0681.html
    http://rhn.redhat.com/errata/RHSA-2013-0682.html
    http://rhn.redhat.com/errata/RHSA-2013-1147.html
    http://rhn.redhat.com/errata/RHSA-2013-1853.html
    http://rhn.redhat.com/errata/RHSA-2014-0224.html
    http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
    http://www.securityfocus.com/bid/58073
    http://www.ubuntu.com/usn/USN-2769-1
    https://access.redhat.com/errata/RHSA-2017:0868
    https://exchange.xforce.ibmcloud.com/vulnerabilities/79984
    https://issues.apache.org/jira/browse/HTTPCLIENT-1265
    http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html
    http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html
    http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html
    http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html
    http://rhn.redhat.com/errata/RHSA-2013-0270.html
    http://rhn.redhat.com/errata/RHSA-2013-0679.html
    http://rhn.redhat.com/errata/RHSA-2013-0680.html
    http://rhn.redhat.com/errata/RHSA-2013-0681.html
    http://rhn.redhat.com/errata/RHSA-2013-0682.html
    http://rhn.redhat.com/errata/RHSA-2013-1147.html
    http://rhn.redhat.com/errata/RHSA-2013-1853.html
    http://rhn.redhat.com/errata/RHSA-2014-0224.html
    http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
    http://www.securityfocus.com/bid/58073
    http://www.ubuntu.com/usn/USN-2769-1
    https://access.redhat.com/errata/RHSA-2017:0868
    https://exchange.xforce.ibmcloud.com/vulnerabilities/79984
    https://issues.apache.org/jira/browse/HTTPCLIENT-1265

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High