{"id":"CVE-2012-5783","published":"2012-11-04T22:00:00Z","modified":"2024-08-06T21:14:16Z","title":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.09254,"percentile":0.95343,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0681.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://issues.apache.org/jira/browse/HTTPCLIENT-1265","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0680.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0868","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.securityfocus.com/bid/58073","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/79984","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0270.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0682.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1853.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf","tags":["x_refsource_MISC"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0679.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1147.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.ubuntu.com/usn/USN-2769-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0224.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":19.1,"factors":[{"name":"EPSS percentile","points":19.07}]},"affected":[{"ecosystem":"Maven","package":"commons-httpclient:commons-httpclient","vulnerableRanges":[">=3.0, <4.0"],"patched":[],"from":["GHSA-3832-9276-x7gf"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2129","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-org-apache-httpcomponents-httpclient-cve-2012-5783","children":[{"from":"CVE-2012-5783","to":"CVE-2012-6153","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.","from":"CVE.org","in":"CVE-2012-6153"}]}]}}