MEDIUM🇵🇱 Wersja polska

CVE-2014-3596

CVSS 5.8v2.0pub. 2014-08-27upd. 2026-05-06

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.

CVSS Vector
AV:N/AC:M/Au:N/C:P/I:P/A:N

  • Apache Axis

    APP
    Apache
    1.01.11.21.2.11.3≤ 1.4
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2023-40743CRITICAL9.8ten sam produkt

** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvio...

CVE-2023-51441HIGH7.2ten sam produkt

** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with acce...

CVE-2019-0227HIGH7.5ten sam produkt

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last rel...

CVE-2018-8032MEDIUM6.1ten sam produkt

Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default se...

CVE-2012-5784MEDIUM5.8ten sam produkt

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information...