CVE-2012-6153
ADVISORY - githubSummary
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.
EPSS Score: 0.00149 (0.515)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Improper Input Validation
ADVISORY - github
Improper Input Validation
ADVISORY - gitlab
ADVISORY - redhat
Improper Validation of Certificate with Host Mismatch
NIST
CREATED
UPDATED
ADVISORY IDCVE-2012-6153
EXPLOITABILITY SCORE
8.6
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
GitHub
CREATED
UPDATED
ADVISORY IDGHSA-2x83-r56g-cv47
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)
Debian
CREATED
UPDATED
ADVISORY IDCVE-2012-6153
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2012-6153
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Amazon
CREATED
UPDATED
ADVISORY IDALAS-2014-410
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Red Hat
CREATED
UPDATED
ADVISORY IDCVE-2012-6153
EXPLOITABILITY SCORE
8.6
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)